Provides a Cloudflare Access Group resource. Access Groups are used in conjunction with Access Policies to restrict access to a particular resource based on group membership.

Conditions

require, exclude and include arguments share the available conditions which can be applied. The conditions are:

• ip - (Optional) A list of IP addresses or ranges. Example: ip = ["1.2.3.4", "10.0.0.0/2"]

• email - (Optional) A list of email addresses. Example: email = ["test@example.com"]

• email_domain - (Optional) A list of email domains. Example: email_domain = ["example.com"]

• service_token - (Optional) A list of service token ids. Example: service_token = [cloudflare_access_service_token.demo.id]

• any_valid_service_token - (Optional) Boolean indicating if allow all tokens to be granted. Example: any_valid_service_token = true

• group - (Optional) A list of access group ids. Example: group = [cloudflare_access_group.demo.id]

• everyone - (Optional) Boolean indicating permitting access for all requests. Example: everyone = true

• certificate - (Optional) Whether to use mTLS certificate authentication.

• common_name - (Optional) Use a certificate common name to authenticate with.

• auth_method - (Optional) A string identifying the authentication method code. The list of codes are listed here: https://tools.ietf.org/html/rfc8176#section-2. Custom values are also supported. Example: auth_method = ["swk"]

• geo - (Optional) A list of country codes. Example: geo = ["US"]

• login_method - (Optional) A list of identity provider ids. Example: login_method = [cloudflare_access_identity_provider.my_idp.id]

• device_posture - (Optional) A list of device_posture integration_uids. Example: device_posture = [cloudflare_device_posture_rule.my_posture_rule.id]

• gsuite - (Optional) Use GSuite as the authentication mechanism. Example:

  # ... other configuration
  include {
    gsuite {
      email = ["admins@example.com"]
      identity_provider_id = "ca298b82-93b5-41bf-bc2d-10493f09b761"
    }
  }
  

• github - (Optional) Use a GitHub organization as the include condition. Example:

  # ... other configuration
  include {
    github {
      name = "my-github-org-name" # (Required) GitHub organization name
      teams = ["my-github-team-name"] # (Optional) GitHub teams
      identity_provider_id = "ca298b82-93b5-41bf-bc2d-10493f09b761"
    }
  }
  

• azure - (Optional) Use Azure AD as the include condition. Example:

  # ... other configuration
  include {
    azure {
      id = ["86773093-5feb-48dd-814b-7ccd3676ff50e"]
      identity_provider_id = "ca298b82-93b5-41bf-bc2d-10493f09b761"
    }
  }
  

• okta - (Optional) Use Okta as the include condition. Example:

  # ... other configuration
  include {
    okta {
      name = ["admins"]
      identity_provider_id = "ca298b82-93b5-41bf-bc2d-10493f09b761"
    }
  }
  

• saml - (Optional) Use an external SAML setup as the include condition. Example:

  # ... other configuration
  include {
    saml {
      attribute_name = "group"
      attribute_value = "admins"
      identity_provider_id = "ca298b82-93b5-41bf-bc2d-10493f09b761"
    }
  }
  

using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

class MyStack : Stack
{
    public MyStack()
    {
        // Allowing access to `test@example.com` email address only
        var testGroupAccessGroup = new Cloudflare.AccessGroup("testGroupAccessGroup", new Cloudflare.AccessGroupArgs
        {
            AccountId = "975ecf5a45e3bcb680dba0722a420ad9",
            Name = "staging group",
            Includes = 
            {
                new Cloudflare.Inputs.AccessGroupIncludeArgs
                {
                    Emails = 
                    {
                        "test@example.com",
                    },
                },
            },
        });
        // Allowing `test@example.com` to access but only when coming from a
        // specific IP.
        var testGroupIndex_accessGroupAccessGroup = new Cloudflare.AccessGroup("testGroupIndex/accessGroupAccessGroup", new Cloudflare.AccessGroupArgs
        {
            AccountId = "975ecf5a45e3bcb680dba0722a420ad9",
            Name = "staging group",
            Includes = 
            {
                new Cloudflare.Inputs.AccessGroupIncludeArgs
                {
                    Emails = 
                    {
                        "test@example.com",
                    },
                },
            },
            Requires = 
            {
                { "ips", 
                {
                    @var.Office_ip,
                } },
            },
        });
    }

}

package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v4/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.NewAccessGroup(ctx, "testGroupAccessGroup", &cloudflare.AccessGroupArgs{
			AccountId: pulumi.String("975ecf5a45e3bcb680dba0722a420ad9"),
			Name:      pulumi.String("staging group"),
			Includes: AccessGroupIncludeArray{
				&AccessGroupIncludeArgs{
					Emails: pulumi.StringArray{
						pulumi.String("test@example.com"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = cloudflare.NewAccessGroup(ctx, "testGroupIndex/accessGroupAccessGroup", &cloudflare.AccessGroupArgs{
			AccountId: pulumi.String("975ecf5a45e3bcb680dba0722a420ad9"),
			Name:      pulumi.String("staging group"),
			Includes: AccessGroupIncludeArray{
				&AccessGroupIncludeArgs{
					Emails: pulumi.StringArray{
						pulumi.String("test@example.com"),
					},
				},
			},
			Requires: AccessGroupRequireArray{
				Ips: AccessGroupRequireArgs{
					_var.Office_ip,
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

import pulumi
import pulumi_cloudflare as cloudflare

# Allowing access to `test@example.com` email address only
test_group_access_group = cloudflare.AccessGroup("testGroupAccessGroup",
    account_id="975ecf5a45e3bcb680dba0722a420ad9",
    name="staging group",
    includes=[cloudflare.AccessGroupIncludeArgs(
        emails=["test@example.com"],
    )])
# Allowing `test@example.com` to access but only when coming from a
# specific IP.
test_group_index_access_group_access_group = cloudflare.AccessGroup("testGroupIndex/accessGroupAccessGroup",
    account_id="975ecf5a45e3bcb680dba0722a420ad9",
    name="staging group",
    includes=[cloudflare.AccessGroupIncludeArgs(
        emails=["test@example.com"],
    )],
    requires={
        "ips": [var["office_ip"]],
    })

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

// Allowing access to `test@example.com` email address only
const testGroupAccessGroup = new cloudflare.AccessGroup("testGroupAccessGroup", {
    accountId: "975ecf5a45e3bcb680dba0722a420ad9",
    name: "staging group",
    includes: [{
        emails: ["test@example.com"],
    }],
});
// Allowing `test@example.com` to access but only when coming from a
// specific IP.
const testGroupIndex_accessGroupAccessGroup = new cloudflare.AccessGroup("testGroupIndex/accessGroupAccessGroup", {
    accountId: "975ecf5a45e3bcb680dba0722a420ad9",
    name: "staging group",
    includes: [{
        emails: ["test@example.com"],
    }],
    requires: {
        ips: [_var.office_ip],
    },
});

Create a AccessGroup Resource

new AccessGroup(name: string, args: AccessGroupArgs, opts?: CustomResourceOptions);

@overload
def AccessGroup(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                account_id: Optional[str] = None,
                excludes: Optional[Sequence[AccessGroupExcludeArgs]] = None,
                includes: Optional[Sequence[AccessGroupIncludeArgs]] = None,
                name: Optional[str] = None,
                requires: Optional[Sequence[AccessGroupRequireArgs]] = None,
                zone_id: Optional[str] = None)
@overload
def AccessGroup(resource_name: str,
                args: AccessGroupArgs,
                opts: Optional[ResourceOptions] = None)

func NewAccessGroup(ctx *Context, name string, args AccessGroupArgs, opts ...ResourceOption) (*AccessGroup, error)

public AccessGroup(string name, AccessGroupArgs args, CustomResourceOptions? opts = null)

public AccessGroup(String name, AccessGroupArgs args)
public AccessGroup(String name, AccessGroupArgs args, CustomResourceOptions options)

type: cloudflare:AccessGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

AccessGroup Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The AccessGroup resource accepts the following input properties:

Outputs

All input properties are implicitly available as output properties. Additionally, the AccessGroup resource produces the following output properties:

Look up an Existing AccessGroup Resource

Get an existing AccessGroup resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AccessGroupState, opts?: CustomResourceOptions): AccessGroup

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        excludes: Optional[Sequence[AccessGroupExcludeArgs]] = None,
        includes: Optional[Sequence[AccessGroupIncludeArgs]] = None,
        name: Optional[str] = None,
        requires: Optional[Sequence[AccessGroupRequireArgs]] = None,
        zone_id: Optional[str] = None) -> AccessGroup

func GetAccessGroup(ctx *Context, name string, id IDInput, state *AccessGroupState, opts ...ResourceOption) (*AccessGroup, error)

public static AccessGroup Get(string name, Input<string> id, AccessGroupState? state, CustomResourceOptions? opts = null)

public static AccessGroup get(String name, Output<String> id, AccessGroupState state, CustomResourceOptions options)

Resource lookup is not supported in YAML

Supporting Types

AccessGroupExclude

AccessGroupExcludeAzure

AccessGroupExcludeGithub

AccessGroupExcludeGsuite

AccessGroupExcludeOkta

AccessGroupExcludeSaml

AccessGroupInclude

AccessGroupIncludeAzure

AccessGroupIncludeGithub

AccessGroupIncludeGsuite

AccessGroupIncludeOkta

AccessGroupIncludeSaml

AccessGroupRequire

AccessGroupRequireAzure

AccessGroupRequireGithub

AccessGroupRequireGsuite

AccessGroupRequireOkta

AccessGroupRequireSaml

Import

Access Groups can be imported using a composite ID formed of account ID and group ID.

 $ pulumi import cloudflare:index/accessGroup:AccessGroup staging 975ecf5a45e3bcb680dba0722a420ad9/67ea780ce4982c1cfbe6b7293afc765d

where * 975ecf5a45e3bcb680dba0722a420ad9 - Account ID * 67ea780ce4982c1cfbe6b7293afc765d - Access Group ID

Package Details

Repository

https://github.com/pulumi/pulumi-cloudflare

License

Apache-2.0

Notes

This Pulumi package is based on the cloudflare Terraform Provider.