🔐 Zero Trust Branch - IAC Repository

2025-12-172025-12-17

Overview

The zero-trust branch in the IAC repository contains Terraform configurations for managing Cloudflare Zero Trust components. This branch is dedicated to deploying and maintaining secure access infrastructure using Cloudflare's Zero Trust Network Access (ZTNA) platform.

What is Zero Trust?

Zero Trust is a security framework that requires all users, whether inside or outside the organization's network, to be authenticated, authorized, and continuously validated before being granted access to applications and data.

🎯 Purpose

The zero-trust branch manages Cloudflare Zero Trust infrastructure to:

• Secure Application Access: Control who can access internal applications without traditional VPNs
• Identity-Based Access: Implement authentication and authorization policies based on user identity
• Network Protection: Secure network traffic through Cloudflare's edge network
• Access Control: Define granular access policies for different applications and services

📁 Repository Structure

iac/
├── managed-services/
│   ├── components/
│   │   └── cloudflare-zero-trust/    # Zero Trust configurations
│   └── modules/
│       └── cloudflare-*               # Reusable Cloudflare modules
├── .github/
│   └── workflows/
│       └── zero-trust-*.yml           # Deployment workflows
└── global-variables.tfvars            # Global configuration

🏗️ Key Components

1. Access Applications

Zero Trust Access Applications define which internal services are protected and how users can access them.

Typical Configuration: - Application endpoints (URLs/domains) - Authentication requirements - Session duration settings - CORS policies

2. Access Policies

Access Policies determine who can access what and when.

Policy Types: - Allow: Grant access to specific groups or users - Deny: Explicitly block access - Bypass: Skip authentication for certain scenarios - Service Auth: Machine-to-machine authentication

3. Identity Providers (IdP)

Integration with authentication providers: - SAML 2.0 providers - OAuth 2.0 providers (Google, GitHub, Azure AD) - One-time PIN (OTP) authentication

4. Access Groups

Logical groupings of users based on: - Email domains - IP addresses - Geographic locations - Device posture - Identity provider attributes

5. Tunnels (Cloudflare Tunnel)

Secure tunnels that connect internal resources to Cloudflare's edge without exposing public IPs.

Benefits: - No inbound firewall rules needed - Encrypted connections - Built-in DDoS protection

🚀 Deployment Process

Prerequisites

Required Access

• Cloudflare account with Zero Trust enabled
• Appropriate Cloudflare API tokens
• GitHub repository access
• Terraform knowledge

Workflow Execution

The deployment is automated through GitHub Actions workflows:

1. Plan Phase

   # Triggered on pull requests to zero-trust branch
   terraform plan -var-file=global-variables.tfvars
   

2. Apply Phase

   # Triggered on merge to zero-trust branch
   terraform apply -var-file=global-variables.tfvars
   

Typical Terraform Files

providers.tfvariables.tfmain.tf

terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }
}

provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

variable "account_id" {
  description = "Cloudflare account ID"
  type        = string
}

variable "zone_id" {
  description = "Cloudflare zone ID"
  type        = string
}

variable "allowed_email_domains" {
  description = "Email domains allowed for access"
  type        = list(string)
}

resource "cloudflare_access_application" "internal_app" {
  zone_id          = var.zone_id
  name             = "Internal Dashboard"
  domain           = "dashboard.internal.example.com"
  session_duration = "24h"
}

resource "cloudflare_access_policy" "dashboard_policy" {
  application_id = cloudflare_access_application.internal_app.id
  zone_id        = var.zone_id
  name           = "Allow Engineering Team"
  precedence     = "1"
  decision       = "allow"

  include {
    email_domain = var.allowed_email_domains
  }
}

🎯 End Result

After successful deployment, the zero-trust branch delivers:

✅ Secure Access Infrastructure

1. Protected Applications
2. Internal services accessible only through Cloudflare's network
3. No exposed public IPs or ports

4. End-to-end encryption

5. Centralized Authentication

6. Single sign-on (SSO) across all protected applications
7. Multi-factor authentication (MFA) enforcement

8. Session management and token rotation

9. Granular Access Control

10. Role-based access policies
11. Time-based access restrictions
12. Device posture requirements

13. Geographic restrictions

14. Audit and Compliance

15. Complete access logs
16. Authentication attempts tracking
17. Policy enforcement monitoring
18. Compliance reporting capabilities

📊 Monitoring & Visibility

Cloudflare Dashboard Access:
  - Real-time access logs
  - User authentication events
  - Policy decisions and blocks
  - Application performance metrics

🔄 Common Operations

Adding a New Application

1. Define the application resource in Terraform
2. Create access policies
3. Configure authentication requirements
4. Open PR to zero-trust branch
5. Review terraform plan
6. Merge to deploy

Updating Access Policies

resource "cloudflare_access_policy" "updated_policy" {
  # ...existing configuration...
  
  # Add new include rule
  include {
    email = ["new.user@example.com"]
  }
  
  # Add require conditions
  require {
    geo = ["US", "CA"]
  }
}

Managing Access Groups

resource "cloudflare_access_group" "engineering_team" {
  account_id = var.account_id
  name       = "Engineering Team"

  include {
    email_domain = ["example.com"]
  }

  require {
    email_domain = ["engineering.example.com"]
  }
}

🛡️ Security Best Practices

Security Guidelines

• Principle of Least Privilege: Grant minimum necessary access
• Regular Audits: Review access logs and policies regularly
• MFA Enforcement: Require multi-factor authentication for all users
• Session Timeouts: Configure appropriate session durations
• Device Posture: Implement device health checks where possible

🔍 Troubleshooting

Common Issues

Authentication FailuresPolicy Not AppliedTunnel Connectivity

Symptom: Users cannot authenticate

Check: - Identity provider configuration - DNS records for access domain - Cloudflare tunnel status - Access policy precedence

Symptom: Access policy changes not taking effect

Solutions:

# Verify terraform state
terraform state list

# Force refresh
terraform refresh

# Check Cloudflare API
# Review policy precedence order

Symptom: Applications not reachable through tunnel

Debug Steps: 1. Check tunnel connector status 2. Verify network connectivity 3. Review tunnel configuration 4. Check application health

📚 Additional Resources

• Cloudflare Zero Trust Documentation
• Terraform Cloudflare Provider
• Zero Trust Architecture Guide

🔗 Related Documentation

• IAC Repository Overview
• GitHub Actions Workflows
• Security Best Practices

---

Benefits Summary

The zero-trust branch provides a Infrastructure-as-Code approach to managing secure access, eliminating the need for traditional VPNs while providing better security, auditability, and user experience.