Zero Trust
Zero TrustDevicesDEX Tests
resource cloudflare_zero_trust_dex_test
required
cloudflare_zero_trust_dex_test
resource "cloudflare_zero_trust_dex_test" "example_zero_trust_dex_test" {
account_id = "01a7362d577a6c3019a474fd6f485823"
data = {
host = "https://dash.cloudflare.com"
kind = "http"
method = "GET"
}
enabled = true
interval = "30m"
name = "HTTP dash health check"
description = "Checks the dash endpoint every 30 minutes"
target_policies = [{
id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
default = true
name = "name"
}]
}
data cloudflare_zero_trust_dex_test
computed
cloudflare_zero_trust_dex_test
data "cloudflare_zero_trust_dex_test" "example_zero_trust_dex_test" {
account_id = "01a7362d577a6c3019a474fd6f485823"
dex_test_id = "372e67954025e0ba6aaa6d586b9e0b59"
}
data cloudflare_zero_trust_dex_tests
optional
cloudflare_zero_trust_dex_tests
data "cloudflare_zero_trust_dex_tests" "example_zero_trust_dex_tests" {
account_id = "01a7362d577a6c3019a474fd6f485823"
kind = "http"
test_name = "testName"
}
Zero TrustDevicesIP Profiles
resource cloudflare_zero_trust_device_ip_profile
required
The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml_attributes”.
optional
cloudflare_zero_trust_device_ip_profile
resource "cloudflare_zero_trust_device_ip_profile" "example_zero_trust_device_ip_profile" {
account_id = "account_id"
match = "identity.email == \"test@cloudflare.com\""
name = "IPv4 Cloudflare Source IPs"
precedence = 100
subnet_id = "b70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
description = "example comment"
enabled = true
}
data cloudflare_zero_trust_device_ip_profile
computed
The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml_attributes”.
cloudflare_zero_trust_device_ip_profile
data "cloudflare_zero_trust_device_ip_profile" "example_zero_trust_device_ip_profile" {
account_id = "account_id"
profile_id = "profile_id"
}
Zero TrustDevicesDeployment Groups
resource cloudflare_zero_trust_device_deployment_groups
cloudflare_zero_trust_device_deployment_groups
resource "cloudflare_zero_trust_device_deployment_groups" "example_zero_trust_device_deployment_groups" {
account_id = "account_id"
name = "Engineering Ring 0"
version_config = [{
target_environment = "windows"
version = "2026.6.234.0"
}]
policy_ids = ["string"]
}
data cloudflare_zero_trust_device_deployment_groups
computed
cloudflare_zero_trust_device_deployment_groups
data "cloudflare_zero_trust_device_deployment_groups" "example_zero_trust_device_deployment_groups" {
account_id = "account_id"
group_id = "group_id"
}
data cloudflare_zero_trust_device_deployment_groups_list
cloudflare_zero_trust_device_deployment_groups_list
data "cloudflare_zero_trust_device_deployment_groups_list" "example_zero_trust_device_deployment_groups_list" {
account_id = "account_id"
}
Zero TrustDevicesNetworks
resource cloudflare_zero_trust_device_managed_networks
required
cloudflare_zero_trust_device_managed_networks
resource "cloudflare_zero_trust_device_managed_networks" "example_zero_trust_device_managed_networks" {
account_id = "699d98642c564d2e855e9661899b7252"
config = {
tls_sockaddr = "foo.bar:1234"
sha256 = "b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c"
}
name = "managed-network-1"
type = "tls"
}
data cloudflare_zero_trust_device_managed_networks
cloudflare_zero_trust_device_managed_networks
data "cloudflare_zero_trust_device_managed_networks" "example_zero_trust_device_managed_networks" {
account_id = "699d98642c564d2e855e9661899b7252"
network_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_managed_networks_list
cloudflare_zero_trust_device_managed_networks_list
data "cloudflare_zero_trust_device_managed_networks_list" "example_zero_trust_device_managed_networks_list" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesDefault
resource cloudflare_zero_trust_device_default_profile
optional
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
cloudflare_zero_trust_device_default_profile
resource "cloudflare_zero_trust_device_default_profile" "example_zero_trust_device_default_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
allow_mode_switch = true
allow_updates = true
allowed_to_leave = true
auto_connect = 0
captive_portal = 180
disable_auto_fallback = true
dns_search_suffixes = [{
suffix = "internal.corp"
description = "Example internal domains"
}]
exclude = [{
address = "192.0.2.0/24"
description = "Exclude testing domains from the tunnel"
}]
exclude_office_ips = true
global_acceleration = {
api_endpoints = ["198.51.100.1:443"]
enabled = true
masque_endpoints = ["198.51.100.1:443"]
wireguard_endpoints = ["198.51.100.1:2408"]
}
include = [{
address = "192.0.2.0/24"
description = "Include testing domains in the tunnel"
}]
lan_allow_minutes = 30
lan_allow_subnet_size = 24
register_interface_ip_with_dns = true
sccm_vpn_boundary_support = false
service_mode_v2 = {
mode = "proxy"
port = 3000
}
support_url = "https://1.1.1.1/help"
switch_locked = true
tunnel_protocol = "wireguard"
virtual_networks = {
allowed = ["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]
default = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
}
data cloudflare_zero_trust_device_default_profile
computed
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
cloudflare_zero_trust_device_default_profile
data "cloudflare_zero_trust_device_default_profile" "example_zero_trust_device_default_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesDefaultFallback Domains
resource cloudflare_zero_trust_device_default_profile_local_domain_fallback
cloudflare_zero_trust_device_default_profile_local_domain_fallback
resource "cloudflare_zero_trust_device_default_profile_local_domain_fallback" "example_zero_trust_device_default_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
domains = [{
suffix = "example.com"
description = "Domain bypass for local development"
dns_server = ["1.1.1.1"]
}]
}
data cloudflare_zero_trust_device_default_profile_local_domain_fallback
cloudflare_zero_trust_device_default_profile_local_domain_fallback
data "cloudflare_zero_trust_device_default_profile_local_domain_fallback" "example_zero_trust_device_default_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesDefaultCertificates
resource cloudflare_zero_trust_device_default_profile_certificates
cloudflare_zero_trust_device_default_profile_certificates
resource "cloudflare_zero_trust_device_default_profile_certificates" "example_zero_trust_device_default_profile_certificates" {
zone_id = "699d98642c564d2e855e9661899b7252"
enabled = true
}
data cloudflare_zero_trust_device_default_profile_certificates
cloudflare_zero_trust_device_default_profile_certificates
data "cloudflare_zero_trust_device_default_profile_certificates" "example_zero_trust_device_default_profile_certificates" {
zone_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesCustom
resource cloudflare_zero_trust_device_custom_profile
required
optional
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
cloudflare_zero_trust_device_custom_profile
resource "cloudflare_zero_trust_device_custom_profile" "example_zero_trust_device_custom_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
match = "identity.email == \"test@cloudflare.com\""
name = "Allow Developers"
precedence = 100
allow_mode_switch = true
allow_updates = true
allowed_to_leave = true
auto_connect = 0
captive_portal = 180
description = "Policy for test teams."
disable_auto_fallback = true
dns_search_suffixes = [{
suffix = "internal.corp"
description = "Example internal domains"
}]
enabled = true
exclude = [{
address = "192.0.2.0/24"
description = "Exclude testing domains from the tunnel"
}]
exclude_office_ips = true
global_acceleration = {
api_endpoints = ["198.51.100.1:443"]
enabled = true
masque_endpoints = ["198.51.100.1:443"]
wireguard_endpoints = ["198.51.100.1:2408"]
}
include = [{
address = "192.0.2.0/24"
description = "Include testing domains in the tunnel"
}]
lan_allow_minutes = 30
lan_allow_subnet_size = 24
register_interface_ip_with_dns = true
sccm_vpn_boundary_support = false
service_mode_v2 = {
mode = "proxy"
port = 3000
}
support_url = "https://1.1.1.1/help"
switch_locked = true
tunnel_protocol = "wireguard"
virtual_networks = {
allowed = ["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]
default = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
}
data cloudflare_zero_trust_device_custom_profile
computed
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service_token_uuid”, “identity.saml_attributes”, “network”, “os.name”, “os.version”.
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
cloudflare_zero_trust_device_custom_profile
data "cloudflare_zero_trust_device_custom_profile" "example_zero_trust_device_custom_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_custom_profiles
cloudflare_zero_trust_device_custom_profiles
data "cloudflare_zero_trust_device_custom_profiles" "example_zero_trust_device_custom_profiles" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesCustomFallback Domains
resource cloudflare_zero_trust_device_custom_profile_local_domain_fallback
cloudflare_zero_trust_device_custom_profile_local_domain_fallback
resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example_zero_trust_device_custom_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
domains = [{
suffix = "example.com"
description = "Domain bypass for local development"
dns_server = ["1.1.1.1"]
}]
}
data cloudflare_zero_trust_device_custom_profile_local_domain_fallback
cloudflare_zero_trust_device_custom_profile_local_domain_fallback
data "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example_zero_trust_device_custom_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
Zero TrustDevicesPosture
resource cloudflare_zero_trust_device_posture_rule
required
cloudflare_zero_trust_device_posture_rule
resource "cloudflare_zero_trust_device_posture_rule" "example_zero_trust_device_posture_rule" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Admin Serial Numbers"
type = "file"
description = "The rule for admin serial numbers"
expiration = "1h"
input = {
operating_system = "linux"
path = "/bin/cat"
exists = true
sha256 = "https://api.us-2.crowdstrike.com"
thumbprint = "0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"
}
match = [{
platform = "windows"
}]
schedule = "1h"
}
data cloudflare_zero_trust_device_posture_rule
cloudflare_zero_trust_device_posture_rule
data "cloudflare_zero_trust_device_posture_rule" "example_zero_trust_device_posture_rule" {
account_id = "699d98642c564d2e855e9661899b7252"
rule_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_posture_rules
cloudflare_zero_trust_device_posture_rules
data "cloudflare_zero_trust_device_posture_rules" "example_zero_trust_device_posture_rules" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPostureIntegrations
resource cloudflare_zero_trust_device_posture_integration
required
cloudflare_zero_trust_device_posture_integration
resource "cloudflare_zero_trust_device_posture_integration" "example_zero_trust_device_posture_integration" {
account_id = "699d98642c564d2e855e9661899b7252"
config = {
api_url = "https://as123.awmdm.com/API"
auth_url = "https://na.uemauth.workspaceone.com/connect/token"
client_id = "example client id"
client_secret = "example client secret"
}
interval = "10m"
name = "My Workspace One Integration"
type = "workspace_one"
}
data cloudflare_zero_trust_device_posture_integration
cloudflare_zero_trust_device_posture_integration
data "cloudflare_zero_trust_device_posture_integration" "example_zero_trust_device_posture_integration" {
account_id = "699d98642c564d2e855e9661899b7252"
integration_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_posture_integrations
cloudflare_zero_trust_device_posture_integrations
data "cloudflare_zero_trust_device_posture_integrations" "example_zero_trust_device_posture_integrations" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesSettings
resource cloudflare_zero_trust_device_settings
optional
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
cloudflare_zero_trust_device_settings
resource "cloudflare_zero_trust_device_settings" "example_zero_trust_device_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
disable_for_time = 0
external_emergency_signal_enabled = true
external_emergency_signal_fingerprint = "abcd1234567890abcd1234567890abcd1234567890abcd1234567890abcd1234"
external_emergency_signal_interval = "5m"
external_emergency_signal_url = "https://192.0.2.1/signal"
gateway_proxy_enabled = true
gateway_udp_proxy_enabled = true
root_certificate_installation_enabled = true
use_zt_virtual_ip = true
}
data cloudflare_zero_trust_device_settings
computed
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
cloudflare_zero_trust_device_settings
data "cloudflare_zero_trust_device_settings" "example_zero_trust_device_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustIdentity Providers
resource cloudflare_zero_trust_access_identity_provider
required
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
cloudflare_zero_trust_access_identity_provider
resource "cloudflare_zero_trust_access_identity_provider" "example_zero_trust_access_identity_provider" {
config = {
claims = ["email_verified", "preferred_username", "custom_claim_name"]
client_id = "<your client id>"
client_secret = "<your client secret>"
conditional_access_enabled = true
directory_id = "<your azure directory uuid>"
email_claim_name = "custom_claim_name"
prompt = "login"
support_groups = true
}
name = "Widget Corps IDP"
type = "onetimepin"
zone_id = "zone_id"
saml_certificate_set_id = "c409ef44-e72c-41c8-8c0b-278c8a6f4fd8"
scim_config = {
enabled = true
identity_update_behavior = "automatic"
seat_deprovision = true
user_deprovision = true
}
}
data cloudflare_zero_trust_access_identity_provider
optional
computed
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
cloudflare_zero_trust_access_identity_provider
data "cloudflare_zero_trust_access_identity_provider" "example_zero_trust_access_identity_provider" {
identity_provider_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_identity_providers
cloudflare_zero_trust_access_identity_providers
data "cloudflare_zero_trust_access_identity_providers" "example_zero_trust_access_identity_providers" {
account_id = "account_id"
zone_id = "zone_id"
scim_enabled = "scim_enabled"
}
Zero TrustOrganizations
resource cloudflare_zero_trust_organization
optional
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed_authenticators’ cannot only contain ‘piv_key’ if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.
cloudflare_zero_trust_organization
resource "cloudflare_zero_trust_organization" "example_zero_trust_organization" {
zone_id = "zone_id"
allow_authenticate_via_warp = true
auth_domain = "test.cloudflareaccess.com"
auto_redirect_to_identity = true
custom_pages = {
forbidden = "699d98642c564d2e855e9661899b7252"
identity_denied = "699d98642c564d2e855e9661899b7252"
}
deny_unmatched_requests = true
deny_unmatched_requests_exempted_zone_names = ["example.com"]
is_ui_read_only = true
login_design = {
background_color = "#c5ed1b"
footer_text = "This is an example description."
header_text = "This is an example description."
logo_path = "https://example.com/logo.png"
text_color = "#c5ed1b"
}
mfa_config = {
allowed_authenticators = ["totp", "biometrics", "security_key"]
amr_matching_session_duration = "12h"
required_aaguids = "2fc0579f-8113-47ea-b116-bb5a8db9202a"
session_duration = "24h"
}
mfa_piv_key_requirements = {
pin_policy = "always"
require_fips_device = true
ssh_key_size = [256, 2048]
ssh_key_type = ["ecdsa", "rsa"]
touch_policy = "always"
}
mfa_required_for_all_apps = false
name = "Widget Corps Internal Applications"
session_duration = "24h"
ui_read_only_toggle_reason = "Temporarily turn off the UI read only lock to make a change via the UI"
user_seat_expiration_inactive_time = "730h"
warp_auth_session_duration = "24h"
}
data cloudflare_zero_trust_organization
optional
computed
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed_authenticators’ cannot only contain ‘piv_key’ if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
A description of the reason why the UI read only field is being toggled.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
cloudflare_zero_trust_organization
data "cloudflare_zero_trust_organization" "example_zero_trust_organization" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessAI ControlsMcpPortals
resource cloudflare_zero_trust_access_ai_controls_mcp_portal
optional
cloudflare_zero_trust_access_ai_controls_mcp_portal
resource "cloudflare_zero_trust_access_ai_controls_mcp_portal" "example_zero_trust_access_ai_controls_mcp_portal" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-portal"
hostname = "exmaple.com"
name = "My MCP Portal"
allow_code_mode = true
description = "This is my custom MCP Portal"
secure_web_gateway = false
servers = [{
server_id = "my-mcp-server"
default_disabled = true
on_behalf = true
updated_prompts = [{
name = "name"
alias = "my-custom-alias"
description = "description"
enabled = true
}]
updated_tools = [{
name = "name"
alias = "my-custom-alias"
description = "description"
enabled = true
}]
}]
}
data cloudflare_zero_trust_access_ai_controls_mcp_portal
cloudflare_zero_trust_access_ai_controls_mcp_portal
data "cloudflare_zero_trust_access_ai_controls_mcp_portal" "example_zero_trust_access_ai_controls_mcp_portal" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-portal"
}
data cloudflare_zero_trust_access_ai_controls_mcp_portals
optional
cloudflare_zero_trust_access_ai_controls_mcp_portals
data "cloudflare_zero_trust_access_ai_controls_mcp_portals" "example_zero_trust_access_ai_controls_mcp_portals" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
search = "search"
}
Zero TrustAccessAI ControlsMcpServers
resource cloudflare_zero_trust_access_ai_controls_mcp_server
optional
cloudflare_zero_trust_access_ai_controls_mcp_server
resource "cloudflare_zero_trust_access_ai_controls_mcp_server" "example_zero_trust_access_ai_controls_mcp_server" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-server"
auth_type = "unauthenticated"
hostname = "https://example.com/mcp"
name = "My MCP Server"
auth_credentials = "auth_credentials"
description = "This is one remote mcp server"
is_shared_oauth_callback_enabled = true
secure_web_gateway = false
updated_prompts = [{
name = "name"
alias = "my-custom-alias"
description = "description"
enabled = true
}]
updated_tools = [{
name = "name"
alias = "my-custom-alias"
description = "description"
enabled = true
}]
}
data cloudflare_zero_trust_access_ai_controls_mcp_server
cloudflare_zero_trust_access_ai_controls_mcp_server
data "cloudflare_zero_trust_access_ai_controls_mcp_server" "example_zero_trust_access_ai_controls_mcp_server" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-server"
}
data cloudflare_zero_trust_access_ai_controls_mcp_servers
cloudflare_zero_trust_access_ai_controls_mcp_servers
data "cloudflare_zero_trust_access_ai_controls_mcp_servers" "example_zero_trust_access_ai_controls_mcp_servers" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
search = "search"
}
Zero TrustAccessInfrastructureTargets
resource cloudflare_zero_trust_access_infrastructure_target
required
cloudflare_zero_trust_access_infrastructure_target
resource "cloudflare_zero_trust_access_infrastructure_target" "example_zero_trust_access_infrastructure_target" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
hostname = "infra-access-target"
ip = {
ipv4 = {
ip_addr = "187.26.29.249"
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
}
ipv6 = {
ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
}
}
}
data cloudflare_zero_trust_access_infrastructure_target
cloudflare_zero_trust_access_infrastructure_target
data "cloudflare_zero_trust_access_infrastructure_target" "example_zero_trust_access_infrastructure_target" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
target_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_access_infrastructure_targets
optional
Filters for targets whose IP addresses look like the specified string.
Supports * as a wildcard character
Defines an IPv4 filter range’s ending value (inclusive). Requires
ipv4_start to be specified as well.
Defines an IPv4 filter range’s starting value (inclusive). Requires
ipv4_end to be specified as well.
Defines an IPv6 filter range’s ending value (inclusive). Requires
ipv6_start to be specified as well.
Defines an IPv6 filter range’s starting value (inclusive). Requires
ipv6_end to be specified as well.
Filters for targets that have any of the following IP addresses. Specify
ips multiple times in query parameter to build list of candidates.
cloudflare_zero_trust_access_infrastructure_targets
data "cloudflare_zero_trust_access_infrastructure_targets" "example_zero_trust_access_infrastructure_targets" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
created_after = "2019-12-27T18:11:19.117Z"
created_before = "2019-12-27T18:11:19.117Z"
direction = "asc"
hostname = "hostname"
hostname_contains = "hostname_contains"
ip_like = "ip_like"
ip_v4 = "ip_v4"
ip_v6 = "ip_v6"
ips = ["string"]
ipv4_end = "ipv4_end"
ipv4_start = "ipv4_start"
ipv6_end = "ipv6_end"
ipv6_start = "ipv6_start"
modified_after = "2019-12-27T18:11:19.117Z"
modified_before = "2019-12-27T18:11:19.117Z"
order = "hostname"
target_ids = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
virtual_network_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustAccessApplicationsCAs
resource cloudflare_zero_trust_access_short_lived_certificate
optional
cloudflare_zero_trust_access_short_lived_certificate
resource "cloudflare_zero_trust_access_short_lived_certificate" "example_zero_trust_access_short_lived_certificate" {
app_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_short_lived_certificate
optional
cloudflare_zero_trust_access_short_lived_certificate
data "cloudflare_zero_trust_access_short_lived_certificate" "example_zero_trust_access_short_lived_certificate" {
app_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_short_lived_certificates
optional
cloudflare_zero_trust_access_short_lived_certificates
data "cloudflare_zero_trust_access_short_lived_certificates" "example_zero_trust_access_short_lived_certificates" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessCertificates
resource cloudflare_zero_trust_access_mtls_certificate
optional
cloudflare_zero_trust_access_mtls_certificate
resource "cloudflare_zero_trust_access_mtls_certificate" "example_zero_trust_access_mtls_certificate" {
certificate = <<EOT
-----BEGIN CERTIFICATE-----
MIIGAjCCA+qgAwIBAgIJAI7kymlF7CWT...N4RI7KKB7nikiuUf8vhULKy5IX10
DrUtmu/B
-----END CERTIFICATE-----
EOT
name = "Allow devs"
zone_id = "zone_id"
associated_hostnames = ["admin.example.com"]
}
data cloudflare_zero_trust_access_mtls_certificate
optional
cloudflare_zero_trust_access_mtls_certificate
data "cloudflare_zero_trust_access_mtls_certificate" "example_zero_trust_access_mtls_certificate" {
certificate_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_mtls_certificates
optional
cloudflare_zero_trust_access_mtls_certificates
data "cloudflare_zero_trust_access_mtls_certificates" "example_zero_trust_access_mtls_certificates" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessCertificatesSettings
resource cloudflare_zero_trust_access_mtls_hostname_settings
optional
computed
Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
cloudflare_zero_trust_access_mtls_hostname_settings
resource "cloudflare_zero_trust_access_mtls_hostname_settings" "example_zero_trust_access_mtls_hostname_settings" {
settings = [{
china_network = false
client_certificate_forwarding = true
hostname = "admin.example.com"
}]
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_mtls_hostname_settings
optional
computed
Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
cloudflare_zero_trust_access_mtls_hostname_settings
data "cloudflare_zero_trust_access_mtls_hostname_settings" "example_zero_trust_access_mtls_hostname_settings" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessGroups
resource cloudflare_zero_trust_access_group
optional
cloudflare_zero_trust_access_group
resource "cloudflare_zero_trust_access_group" "example_zero_trust_access_group" {
include = [{
certificate = {
}
}]
name = "Allow devs"
zone_id = "zone_id"
exclude = [{
certificate = {
}
}]
is_default = true
require = [{
certificate = {
}
}]
}
data cloudflare_zero_trust_access_group
optional
cloudflare_zero_trust_access_group
data "cloudflare_zero_trust_access_group" "example_zero_trust_access_group" {
group_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_groups
optional
cloudflare_zero_trust_access_groups
data "cloudflare_zero_trust_access_groups" "example_zero_trust_access_groups" {
account_id = "account_id"
zone_id = "zone_id"
name = "name"
search = "search"
}
Zero TrustAccessService Tokens
resource cloudflare_zero_trust_access_service_token
optional
The expiration of the previous client_secret. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise.
cloudflare_zero_trust_access_service_token
resource "cloudflare_zero_trust_access_service_token" "example_zero_trust_access_service_token" {
name = "CI/CD token"
zone_id = "zone_id"
client_secret_version = 0
duration = "60m"
previous_client_secret_expires_at = "2014-01-01T05:20:00.12345Z"
}
data cloudflare_zero_trust_access_service_token
optional
computed
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
cloudflare_zero_trust_access_service_token
data "cloudflare_zero_trust_access_service_token" "example_zero_trust_access_service_token" {
service_token_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_service_tokens
optional
cloudflare_zero_trust_access_service_tokens
data "cloudflare_zero_trust_access_service_tokens" "example_zero_trust_access_service_tokens" {
account_id = "account_id"
zone_id = "zone_id"
name = "name"
search = "search"
}
Zero TrustAccessKeys
resource cloudflare_zero_trust_access_key_configuration
required
cloudflare_zero_trust_access_key_configuration
resource "cloudflare_zero_trust_access_key_configuration" "example_zero_trust_access_key_configuration" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
key_rotation_interval_days = 30
}
data cloudflare_zero_trust_access_key_configuration
cloudflare_zero_trust_access_key_configuration
data "cloudflare_zero_trust_access_key_configuration" "example_zero_trust_access_key_configuration" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustAccessCustom Pages
resource cloudflare_zero_trust_access_custom_page
required
cloudflare_zero_trust_access_custom_page
resource "cloudflare_zero_trust_access_custom_page" "example_zero_trust_access_custom_page" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
custom_html = "<html><body><h1>Access Denied</h1></body></html>"
name = "name"
type = "identity_denied"
}
data cloudflare_zero_trust_access_custom_page
cloudflare_zero_trust_access_custom_page
data "cloudflare_zero_trust_access_custom_page" "example_zero_trust_access_custom_page" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
custom_page_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_access_custom_pages
cloudflare_zero_trust_access_custom_pages
data "cloudflare_zero_trust_access_custom_pages" "example_zero_trust_access_custom_pages" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustAccessTags
Zero TrustAccessPolicies
resource cloudflare_zero_trust_access_policy
required
optional
Requires the user to request access from an administrator at the start of each session.
Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
cloudflare_zero_trust_access_policy
resource "cloudflare_zero_trust_access_policy" "example_zero_trust_access_policy" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
decision = "allow"
include = [{
certificate = {
}
}]
name = "Allow devs"
approval_groups = [{
approvals_needed = 1
email_addresses = ["test1@cloudflare.com", "test2@cloudflare.com"]
email_list_uuid = "email_list_uuid"
}, {
approvals_needed = 3
email_addresses = ["test@cloudflare.com", "test2@cloudflare.com"]
email_list_uuid = "597147a1-976b-4ef2-9af0-81d5d007fc34"
}]
approval_required = true
connection_rules = {
rdp = {
allowed_clipboard_local_to_remote_formats = ["text"]
allowed_clipboard_remote_to_local_formats = ["text"]
}
}
exclude = [{
certificate = {
}
}]
isolation_required = false
mfa_config = {
allowed_authenticators = ["totp", "biometrics", "security_key"]
mfa_disabled = false
session_duration = "24h"
}
purpose_justification_prompt = "Please enter a justification for entering this protected domain."
purpose_justification_required = true
require = [{
certificate = {
}
}]
session_duration = "24h"
}
data cloudflare_zero_trust_access_policy
computed
Requires the user to request access from an administrator at the start of each session.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
cloudflare_zero_trust_access_policy
data "cloudflare_zero_trust_access_policy" "example_zero_trust_access_policy" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_access_policies
cloudflare_zero_trust_access_policies
data "cloudflare_zero_trust_access_policies" "example_zero_trust_access_policies" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustDEXRules
resource cloudflare_zero_trust_dex_rule
required
cloudflare_zero_trust_dex_rule
resource "cloudflare_zero_trust_dex_rule" "example_zero_trust_dex_rule" {
account_id = "01a7362d577a6c3019a474fd6f485823"
match = "match"
name = "name"
description = "description"
}
data cloudflare_zero_trust_dex_rule
required
cloudflare_zero_trust_dex_rule
data "cloudflare_zero_trust_dex_rule" "example_zero_trust_dex_rule" {
account_id = "01a7362d577a6c3019a474fd6f485823"
rule_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_dex_rules
optional
cloudflare_zero_trust_dex_rules
data "cloudflare_zero_trust_dex_rules" "example_zero_trust_dex_rules" {
account_id = "01a7362d577a6c3019a474fd6f485823"
name = "name"
}
Zero TrustTunnelsCloudflared
resource cloudflare_zero_trust_tunnel_cloudflared
optional
computed
Timestamp of when the tunnel established at least one connection to Cloudflare’s edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare’s edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_cloudflared
resource "cloudflare_zero_trust_tunnel_cloudflared" "example_zero_trust_tunnel_cloudflared" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "blog"
config_src = "cloudflare"
tunnel_secret = "AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg="
}
data cloudflare_zero_trust_tunnel_cloudflared
computed
Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard.
Timestamp of when the tunnel established at least one connection to Cloudflare’s edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare’s edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_cloudflared
data "cloudflare_zero_trust_tunnel_cloudflared" "example_zero_trust_tunnel_cloudflared" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_cloudflareds
optional
If provided, include only resources that were created (and not deleted) before this time. URL encoded.
If true, only include deleted tunnels. If false, exclude deleted tunnels. If empty, all tunnels will be included.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_cloudflareds
data "cloudflare_zero_trust_tunnel_cloudflareds" "example_zero_trust_tunnel_cloudflareds" {
account_id = "699d98642c564d2e855e9661899b7252"
exclude_prefix = "vpc1-"
existed_at = "2019-10-12T07%3A20%3A50.52Z"
include_prefix = "vpc1-"
is_deleted = true
name = "blog"
status = "healthy"
uuid = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
was_active_at = "2009-11-10T23:00:00Z"
was_inactive_at = "2009-11-10T23:00:00Z"
}
Zero TrustTunnelsCloudflaredConfigurations
resource cloudflare_zero_trust_tunnel_cloudflared_config
cloudflare_zero_trust_tunnel_cloudflared_config
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "example_zero_trust_tunnel_cloudflared_config" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
config = {
ingress = [{
hostname = "tunnel.example.com"
service = "https://localhost:8001"
origin_request = {
access = {
aud_tag = ["string"]
team_name = "zero-trust-organization-name"
required = false
}
ca_pool = "caPool"
connect_timeout = 10
disable_chunked_encoding = true
http2_origin = true
http_host_header = "httpHostHeader"
keep_alive_connections = 100
keep_alive_timeout = 90
match_sn_ito_host = false
no_happy_eyeballs = false
no_tls_verify = false
origin_server_name = "originServerName"
proxy_type = "proxyType"
tcp_keep_alive = 30
tls_timeout = 10
}
path = "subpath"
}]
origin_request = {
access = {
aud_tag = ["string"]
team_name = "zero-trust-organization-name"
required = false
}
ca_pool = "caPool"
connect_timeout = 10
disable_chunked_encoding = true
http2_origin = true
http_host_header = "httpHostHeader"
keep_alive_connections = 100
keep_alive_timeout = 90
match_sn_ito_host = false
no_happy_eyeballs = false
no_tls_verify = false
origin_server_name = "originServerName"
proxy_type = "proxyType"
tcp_keep_alive = 30
tls_timeout = 10
}
}
}
data cloudflare_zero_trust_tunnel_cloudflared_config
computed
cloudflare_zero_trust_tunnel_cloudflared_config
data "cloudflare_zero_trust_tunnel_cloudflared_config" "example_zero_trust_tunnel_cloudflared_config" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustTunnelsCloudflaredToken
data cloudflare_zero_trust_tunnel_cloudflared_token
cloudflare_zero_trust_tunnel_cloudflared_token
data "cloudflare_zero_trust_tunnel_cloudflared_token" "example_zero_trust_tunnel_cloudflared_token" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustTunnelsWARP Connector
resource cloudflare_zero_trust_tunnel_warp_connector
optional
computed
Timestamp of when the tunnel established at least one connection to Cloudflare’s edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare’s edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_warp_connector
resource "cloudflare_zero_trust_tunnel_warp_connector" "example_zero_trust_tunnel_warp_connector" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "blog"
ha = true
}
data cloudflare_zero_trust_tunnel_warp_connector
computed
Timestamp of when the tunnel established at least one connection to Cloudflare’s edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare’s edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_warp_connector
data "cloudflare_zero_trust_tunnel_warp_connector" "example_zero_trust_tunnel_warp_connector" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_warp_connectors
optional
If provided, include only resources that were created (and not deleted) before this time. URL encoded.
If true, only include deleted tunnels. If false, exclude deleted tunnels. If empty, all tunnels will be included.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_warp_connectors
data "cloudflare_zero_trust_tunnel_warp_connectors" "example_zero_trust_tunnel_warp_connectors" {
account_id = "699d98642c564d2e855e9661899b7252"
exclude_prefix = "vpc1-"
existed_at = "2019-10-12T07%3A20%3A50.52Z"
include_prefix = "vpc1-"
is_deleted = true
name = "blog"
status = "healthy"
uuid = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
was_active_at = "2009-11-10T23:00:00Z"
was_inactive_at = "2009-11-10T23:00:00Z"
}
Zero TrustTunnelsWARP ConnectorToken
data cloudflare_zero_trust_tunnel_warp_connector_token
cloudflare_zero_trust_tunnel_warp_connector_token
data "cloudflare_zero_trust_tunnel_warp_connector_token" "example_zero_trust_tunnel_warp_connector_token" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustTunnelsWARP ConnectorConfigurations
resource cloudflare_zero_trust_tunnel_warp_connector_config
required
High-availability mode for the WARP Connector tunnel. none means HA is enabled but no provider is configured yet (newly created tunnels default to this). disabled means HA is explicitly turned off. aws uses AWS ENI move for failover. local uses virtual IPs (VIPs) on the local interface.
cloudflare_zero_trust_tunnel_warp_connector_config
resource "cloudflare_zero_trust_tunnel_warp_connector_config" "example_zero_trust_tunnel_warp_connector_config" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
ha_mode = "aws"
config = {
fnr_id = "eni-0123456789abcdef0"
}
}
data cloudflare_zero_trust_tunnel_warp_connector_config
computed
Monotonically increasing configuration version, incremented on each PUT.
High-availability mode for the WARP Connector tunnel. none means HA is enabled but no provider is configured yet (newly created tunnels default to this). disabled means HA is explicitly turned off. aws uses AWS ENI move for failover. local uses virtual IPs (VIPs) on the local interface.
cloudflare_zero_trust_tunnel_warp_connector_config
data "cloudflare_zero_trust_tunnel_warp_connector_config" "example_zero_trust_tunnel_warp_connector_config" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustDLPCustom Prompt Topics
data cloudflare_zero_trust_dlp_custom_prompt_topic
cloudflare_zero_trust_dlp_custom_prompt_topic
data "cloudflare_zero_trust_dlp_custom_prompt_topic" "example_zero_trust_dlp_custom_prompt_topic" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_custom_prompt_topics
cloudflare_zero_trust_dlp_custom_prompt_topics
data "cloudflare_zero_trust_dlp_custom_prompt_topics" "example_zero_trust_dlp_custom_prompt_topics" {
account_id = "account_id"
}
Zero TrustDLPDatasets
resource cloudflare_zero_trust_dlp_dataset
optional
Dataset encoding version
Non-secret custom word lists with no header are always version 1. Secret EDM lists with no header are version 1. Multicolumn CSV with headers are version 2. Omitting this field provides the default value 0, which is interpreted the same as 1.
Generate a secret dataset.
If true, the response will include a secret to use with the EDM encoder. If false, the response has no secret and the dataset is uploaded in plaintext.
cloudflare_zero_trust_dlp_dataset
resource "cloudflare_zero_trust_dlp_dataset" "example_zero_trust_dlp_dataset" {
account_id = "account_id"
name = "name"
case_sensitive = true
description = "description"
encoding_version = 0
secret = true
}
data cloudflare_zero_trust_dlp_dataset
computed
cloudflare_zero_trust_dlp_dataset
data "cloudflare_zero_trust_dlp_dataset" "example_zero_trust_dlp_dataset" {
account_id = "account_id"
dataset_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPSettings
resource cloudflare_zero_trust_dlp_settings
optional
cloudflare_zero_trust_dlp_settings
resource "cloudflare_zero_trust_dlp_settings" "example_zero_trust_dlp_settings" {
account_id = "account_id"
ai_context_analysis = true
ocr = true
payload_logging = {
masking_level = "full"
public_key = "public_key"
}
}
data cloudflare_zero_trust_dlp_settings
cloudflare_zero_trust_dlp_settings
data "cloudflare_zero_trust_dlp_settings" "example_zero_trust_dlp_settings" {
account_id = "account_id"
}
Zero TrustDLPProfilesCustom
resource cloudflare_zero_trust_dlp_custom_profile
cloudflare_zero_trust_dlp_custom_profile
resource "cloudflare_zero_trust_dlp_custom_profile" "example_zero_trust_dlp_custom_profile" {
account_id = "account_id"
name = "name"
ai_context_enabled = true
allowed_match_count = 5
confidence_threshold = "confidence_threshold"
context_awareness = {
enabled = true
skip = {
files = true
}
}
data_classes = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
data_tags = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
description = "description"
ocr_enabled = true
sensitivity_levels = [{
group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
level_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}]
shared_entries = [{
enabled = true
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}]
}
data cloudflare_zero_trust_dlp_custom_profile
cloudflare_zero_trust_dlp_custom_profile
data "cloudflare_zero_trust_dlp_custom_profile" "example_zero_trust_dlp_custom_profile" {
account_id = "account_id"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPProfilesPredefined
resource cloudflare_zero_trust_dlp_predefined_profile
optional
cloudflare_zero_trust_dlp_predefined_profile
resource "cloudflare_zero_trust_dlp_predefined_profile" "example_zero_trust_dlp_predefined_profile" {
account_id = "account_id"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
ai_context_enabled = true
allowed_match_count = 5
confidence_threshold = "confidence_threshold"
enabled_entries = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
entries = [{
id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
enabled = true
}]
ocr_enabled = true
}
data cloudflare_zero_trust_dlp_predefined_profile
cloudflare_zero_trust_dlp_predefined_profile
data "cloudflare_zero_trust_dlp_predefined_profile" "example_zero_trust_dlp_predefined_profile" {
account_id = "account_id"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPEntries
resource cloudflare_zero_trust_dlp_entry
cloudflare_zero_trust_dlp_entry
resource "cloudflare_zero_trust_dlp_entry" "example_zero_trust_dlp_entry" {
account_id = "account_id"
enabled = true
name = "name"
pattern = {
regex = "regex"
validation = "luhn"
}
description = "description"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_entry
cloudflare_zero_trust_dlp_entry
data "cloudflare_zero_trust_dlp_entry" "example_zero_trust_dlp_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPEntriesCustom
resource cloudflare_zero_trust_dlp_custom_entry
cloudflare_zero_trust_dlp_custom_entry
resource "cloudflare_zero_trust_dlp_custom_entry" "example_zero_trust_dlp_custom_entry" {
account_id = "account_id"
enabled = true
name = "name"
pattern = {
regex = "regex"
validation = "luhn"
}
description = "description"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_custom_entry
cloudflare_zero_trust_dlp_custom_entry
data "cloudflare_zero_trust_dlp_custom_entry" "example_zero_trust_dlp_custom_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPEntriesPredefined
resource cloudflare_zero_trust_dlp_predefined_entry
optional
computed
cloudflare_zero_trust_dlp_predefined_entry
resource "cloudflare_zero_trust_dlp_predefined_entry" "example_zero_trust_dlp_predefined_entry" {
account_id = "account_id"
enabled = true
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_predefined_entry
cloudflare_zero_trust_dlp_predefined_entry
data "cloudflare_zero_trust_dlp_predefined_entry" "example_zero_trust_dlp_predefined_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_predefined_entries
cloudflare_zero_trust_dlp_predefined_entries
data "cloudflare_zero_trust_dlp_predefined_entries" "example_zero_trust_dlp_predefined_entries" {
account_id = "account_id"
}
Zero TrustDLPEntriesIntegration
resource cloudflare_zero_trust_dlp_integration_entry
optional
computed
cloudflare_zero_trust_dlp_integration_entry
resource "cloudflare_zero_trust_dlp_integration_entry" "example_zero_trust_dlp_integration_entry" {
account_id = "account_id"
enabled = true
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_integration_entry
cloudflare_zero_trust_dlp_integration_entry
data "cloudflare_zero_trust_dlp_integration_entry" "example_zero_trust_dlp_integration_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_integration_entries
cloudflare_zero_trust_dlp_integration_entries
data "cloudflare_zero_trust_dlp_integration_entries" "example_zero_trust_dlp_integration_entries" {
account_id = "account_id"
}
Zero TrustDLPSensitivity Groups
resource cloudflare_zero_trust_dlp_sensitivity_group
cloudflare_zero_trust_dlp_sensitivity_group
resource "cloudflare_zero_trust_dlp_sensitivity_group" "example_zero_trust_dlp_sensitivity_group" {
account_id = "account_id"
name = "name"
description = "description"
}
data cloudflare_zero_trust_dlp_sensitivity_group
cloudflare_zero_trust_dlp_sensitivity_group
data "cloudflare_zero_trust_dlp_sensitivity_group" "example_zero_trust_dlp_sensitivity_group" {
account_id = "account_id"
sensitivity_group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_sensitivity_groups
cloudflare_zero_trust_dlp_sensitivity_groups
data "cloudflare_zero_trust_dlp_sensitivity_groups" "example_zero_trust_dlp_sensitivity_groups" {
account_id = "account_id"
}
Zero TrustDLPSensitivity GroupsLevels
resource cloudflare_zero_trust_dlp_sensitivity_level
cloudflare_zero_trust_dlp_sensitivity_level
resource "cloudflare_zero_trust_dlp_sensitivity_level" "example_zero_trust_dlp_sensitivity_level" {
account_id = "account_id"
sensitivity_group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
name = "name"
description = "description"
}
data cloudflare_zero_trust_dlp_sensitivity_level
cloudflare_zero_trust_dlp_sensitivity_level
data "cloudflare_zero_trust_dlp_sensitivity_level" "example_zero_trust_dlp_sensitivity_level" {
account_id = "account_id"
sensitivity_group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
sensitivity_level_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_sensitivity_levels
cloudflare_zero_trust_dlp_sensitivity_levels
data "cloudflare_zero_trust_dlp_sensitivity_levels" "example_zero_trust_dlp_sensitivity_levels" {
account_id = "account_id"
sensitivity_group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPSensitivity GroupsLevelsOrder
resource cloudflare_zero_trust_dlp_sensitivity_level_order
cloudflare_zero_trust_dlp_sensitivity_level_order
resource "cloudflare_zero_trust_dlp_sensitivity_level_order" "example_zero_trust_dlp_sensitivity_level_order" {
account_id = "account_id"
sensitivity_group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
level_ids = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
}
data cloudflare_zero_trust_dlp_sensitivity_level_order
cloudflare_zero_trust_dlp_sensitivity_level_order
data "cloudflare_zero_trust_dlp_sensitivity_level_order" "example_zero_trust_dlp_sensitivity_level_order" {
account_id = "account_id"
sensitivity_group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPData Tag Categories
resource cloudflare_zero_trust_dlp_data_tag_category
cloudflare_zero_trust_dlp_data_tag_category
resource "cloudflare_zero_trust_dlp_data_tag_category" "example_zero_trust_dlp_data_tag_category" {
account_id = "account_id"
name = "name"
description = "description"
}
data cloudflare_zero_trust_dlp_data_tag_category
cloudflare_zero_trust_dlp_data_tag_category
data "cloudflare_zero_trust_dlp_data_tag_category" "example_zero_trust_dlp_data_tag_category" {
account_id = "account_id"
category_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_data_tag_categories
cloudflare_zero_trust_dlp_data_tag_categories
data "cloudflare_zero_trust_dlp_data_tag_categories" "example_zero_trust_dlp_data_tag_categories" {
account_id = "account_id"
}
Zero TrustDLPData Tag CategoriesData Tags
cloudflare_zero_trust_dlp_data_tag
resource "cloudflare_zero_trust_dlp_data_tag" "example_zero_trust_dlp_data_tag" {
account_id = "account_id"
category_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
name = "name"
description = "description"
}
Zero TrustDLPData Classes
resource cloudflare_zero_trust_dlp_data_class
cloudflare_zero_trust_dlp_data_class
resource "cloudflare_zero_trust_dlp_data_class" "example_zero_trust_dlp_data_class" {
account_id = "account_id"
data_tags = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
expression = "expression"
name = "name"
sensitivity_levels = [{
group_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
level_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}]
description = "description"
}
data cloudflare_zero_trust_dlp_data_class
cloudflare_zero_trust_dlp_data_class
data "cloudflare_zero_trust_dlp_data_class" "example_zero_trust_dlp_data_class" {
account_id = "account_id"
data_class_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustGatewayCategories
data cloudflare_zero_trust_gateway_categories_list
cloudflare_zero_trust_gateway_categories_list
data "cloudflare_zero_trust_gateway_categories_list" "example_zero_trust_gateway_categories_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustGatewayApp Types
data cloudflare_zero_trust_gateway_app_types_list
cloudflare_zero_trust_gateway_app_types_list
data "cloudflare_zero_trust_gateway_app_types_list" "example_zero_trust_gateway_app_types_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustGatewayConfigurations
resource cloudflare_zero_trust_gateway_settings
cloudflare_zero_trust_gateway_settings
resource "cloudflare_zero_trust_gateway_settings" "example_zero_trust_gateway_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
settings = {
activity_log = {
enabled = true
}
antivirus = {
enabled_download_phase = false
enabled_upload_phase = false
fail_closed = false
notification_settings = {
enabled = true
include_context = true
msg = "msg"
support_url = "support_url"
}
}
block_page = {
background_color = "background_color"
enabled = true
footer_text = "--footer--"
header_text = "--header--"
include_context = true
logo_path = "https://logos.com/a.png"
mailto_address = "admin@example.com"
mailto_subject = "Blocked User Inquiry"
mode = ""
name = "Cloudflare"
suppress_footer = false
target_uri = "https://example.com"
}
body_scanning = {
inspection_mode = "deep"
}
browser_isolation = {
non_identity_enabled = true
url_browser_isolation_enabled = true
}
certificate = {
id = "d1b364c5-1311-466e-a194-f0e943e0799f"
}
custom_certificate = {
enabled = true
id = "d1b364c5-1311-466e-a194-f0e943e0799f"
}
extended_email_matching = {
enabled = true
}
fips = {
tls = true
}
host_selector = {
enabled = false
}
inspection = {
mode = "static"
}
max_ttl_secs = 3600
protocol_detection = {
enabled = true
}
sandbox = {
enabled = true
fallback_action = "allow"
}
tls_decrypt = {
enabled = true
}
}
}