推荐的网络策略

resource "cloudflare_zero_trust_gateway_policy" "quarantined_users_net_restricted_access" {
  account_id  = var.cloudflare_account_id
  name        = "Quarantined-Users-NET-Restricted-Access"
  description = "限制 IdP 风险用户组中包含的用户的访问权限"
  precedence  = 0
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_allowlist.id}) or not(net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_allowlist.id}) or not(any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_allowlist.id}))"
  identity    = "any(identity.groups.name[*] in {\"Quarantined Users\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "posture_fail_net_restricted_access" {
  account_id  = var.cloudflare_account_id
  name        = "Posture-Fail-NET-Restricted-Access"
  description = "限制基线设备状态检查未通过的设备的访问"
  precedence  = 10
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_allowlist.id}) or not(net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_allowlist.id}) or not(any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_allowlist.id}))"
  device_posture = "not(any(device_posture.checks.passed[*] in {\"${cloudflare_device_posture_rule.baseline_check.id}\"}))"
}

resource "cloudflare_zero_trust_gateway_policy" "finance_users_net_https_finance_servers" {
  account_id  = var.cloudflare_account_id
  name        = "FinanceUsers-NET-HTTPS-FinanceServers"
  description = "允许用户组的 HTTPS 访问"
  precedence  = 20
  enabled     = true
  action      = "allow"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.finance_servers_list.id}"
  identity    = "any(identity.groups.name[*] in {\"Finance Users\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_internet_blocklist" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-Internet-Blocklist"
  description = "阻断发送到恶意或有风险的目的地 IP、SNI 和 SNI 域名的流量"
  precedence  = 30
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id} and net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_blocklist.id} and any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_blocklist.id})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_ssh_internet_allowlist" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-SSH-Internet-Allowlist"
  description = "允许特定用户发送到互联网上特定端点的 SSH 流量"
  precedence  = 40
  enabled     = true
  action      = "allow"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ssh_ip_allowlist.id} and net.sni.host in ${"$"}${cloudflare_zero_trust_list.ssh_fqdn_allowlist.id} and net.detected_protocol == \"ssh\""
  identity    = "any(identity.groups.name[*] in {\"SSH-Allowed-Users\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_no_http_https_internet_deny" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-NO-HTTP-HTTPS-Internet-Deny"
  description = "阻断发送到互联网的所有非 Web 流量"
  precedence  = 50
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.internal_network_ip_list.id}) and not(net.detected_protocol in {\"http\" \"http2\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_internalnetwork_implicitdeny" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-InternalNetwork-ImplicitDeny"
  description = "隐式拒绝列表中包含的所有内部 IP 范围"
  precedence  = 60
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.internal_network_ip_list.id}"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_applicationaccess_allow" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-ApplicationAccess-Allow"
  description = "Ensure access to the application comes from authorized WARP clients"
  precedence  = 70
  enabled     = false
  action      = "block"
  filters     = ["l4"]
  traffic     = "any(net.sni.domains[*] == \"internalapp.com\")"
  posture			=	"not(any(device_posture.checks.passed[*] in {\"${"$"}${cloudflare_zero_trust_list.allowed_devices_sn_list.id}\"}))"
}