Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Cloudflare Provider
  3. API Docs
  4. ZeroTrustGatewayPolicy
Cloudflare v5.49.1 published on Tuesday, Feb 18, 2025 by Pulumi
pulumi/pulumi-cloudflare

cloudflare.ZeroTrustGatewayPolicy

Explore with Pulumi AI

Cloudflare v5.49.1 published on Tuesday, Feb 18, 2025 by Pulumi
pulumi/pulumi-cloudflare

Provides a Cloudflare Teams rule resource. Teams rules comprise secure web gateway policies.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const example = new cloudflare.ZeroTrustGatewayPolicy("example", {
    accountId: "f037e56e89293a057740de681ac9abbe",
    name: "office",
    description: "desc",
    precedence: 1,
    action: "block",
    filters: ["http"],
    traffic: "http.request.uri == \"https://www.example.com/malicious\"",
    ruleSettings: {
        blockPageEnabled: true,
        blockPageReason: "access not permitted",
    },
});
Copy
import pulumi
import pulumi_cloudflare as cloudflare

example = cloudflare.ZeroTrustGatewayPolicy("example",
    account_id="f037e56e89293a057740de681ac9abbe",
    name="office",
    description="desc",
    precedence=1,
    action="block",
    filters=["http"],
    traffic="http.request.uri == \"https://www.example.com/malicious\"",
    rule_settings={
        "block_page_enabled": True,
        "block_page_reason": "access not permitted",
    })
Copy
package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v5/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.NewZeroTrustGatewayPolicy(ctx, "example", &cloudflare.ZeroTrustGatewayPolicyArgs{
			AccountId:   pulumi.String("f037e56e89293a057740de681ac9abbe"),
			Name:        pulumi.String("office"),
			Description: pulumi.String("desc"),
			Precedence:  pulumi.Int(1),
			Action:      pulumi.String("block"),
			Filters: pulumi.StringArray{
				pulumi.String("http"),
			},
			Traffic: pulumi.String("http.request.uri == \"https://www.example.com/malicious\""),
			RuleSettings: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsArgs{
				BlockPageEnabled: pulumi.Bool(true),
				BlockPageReason:  pulumi.String("access not permitted"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var example = new Cloudflare.ZeroTrustGatewayPolicy("example", new()
    {
        AccountId = "f037e56e89293a057740de681ac9abbe",
        Name = "office",
        Description = "desc",
        Precedence = 1,
        Action = "block",
        Filters = new[]
        {
            "http",
        },
        Traffic = "http.request.uri == \"https://www.example.com/malicious\"",
        RuleSettings = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsArgs
        {
            BlockPageEnabled = true,
            BlockPageReason = "access not permitted",
        },
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.ZeroTrustGatewayPolicy;
import com.pulumi.cloudflare.ZeroTrustGatewayPolicyArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustGatewayPolicyRuleSettingsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new ZeroTrustGatewayPolicy("example", ZeroTrustGatewayPolicyArgs.builder()
            .accountId("f037e56e89293a057740de681ac9abbe")
            .name("office")
            .description("desc")
            .precedence(1)
            .action("block")
            .filters("http")
            .traffic("http.request.uri == \"https://www.example.com/malicious\"")
            .ruleSettings(ZeroTrustGatewayPolicyRuleSettingsArgs.builder()
                .blockPageEnabled(true)
                .blockPageReason("access not permitted")
                .build())
            .build());

    }
}
Copy
resources:
  example:
    type: cloudflare:ZeroTrustGatewayPolicy
    properties:
      accountId: f037e56e89293a057740de681ac9abbe
      name: office
      description: desc
      precedence: 1
      action: block
      filters:
        - http
      traffic: http.request.uri == "https://www.example.com/malicious"
      ruleSettings:
        blockPageEnabled: true
        blockPageReason: access not permitted
Copy

Create ZeroTrustGatewayPolicy Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new ZeroTrustGatewayPolicy(name: string, args: ZeroTrustGatewayPolicyArgs, opts?: CustomResourceOptions);
@overload
def ZeroTrustGatewayPolicy(resource_name: str,
                           args: ZeroTrustGatewayPolicyArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def ZeroTrustGatewayPolicy(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           account_id: Optional[str] = None,
                           action: Optional[str] = None,
                           description: Optional[str] = None,
                           name: Optional[str] = None,
                           precedence: Optional[int] = None,
                           device_posture: Optional[str] = None,
                           enabled: Optional[bool] = None,
                           filters: Optional[Sequence[str]] = None,
                           identity: Optional[str] = None,
                           rule_settings: Optional[ZeroTrustGatewayPolicyRuleSettingsArgs] = None,
                           traffic: Optional[str] = None)
func NewZeroTrustGatewayPolicy(ctx *Context, name string, args ZeroTrustGatewayPolicyArgs, opts ...ResourceOption) (*ZeroTrustGatewayPolicy, error)
public ZeroTrustGatewayPolicy(string name, ZeroTrustGatewayPolicyArgs args, CustomResourceOptions? opts = null)
public ZeroTrustGatewayPolicy(String name, ZeroTrustGatewayPolicyArgs args)
public ZeroTrustGatewayPolicy(String name, ZeroTrustGatewayPolicyArgs args, CustomResourceOptions options)

type: cloudflare:ZeroTrustGatewayPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. ZeroTrustGatewayPolicyArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. ZeroTrustGatewayPolicyArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. ZeroTrustGatewayPolicyArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. ZeroTrustGatewayPolicyArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. ZeroTrustGatewayPolicyArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var zeroTrustGatewayPolicyResource = new Cloudflare.ZeroTrustGatewayPolicy("zeroTrustGatewayPolicyResource", new()
{
    AccountId = "string",
    Action = "string",
    Description = "string",
    Name = "string",
    Precedence = 0,
    DevicePosture = "string",
    Enabled = false,
    Filters = new[]
    {
        "string",
    },
    Identity = "string",
    RuleSettings = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsArgs
    {
        AddHeaders = 
        {
            { "string", "string" },
        },
        AllowChildBypass = false,
        AuditSsh = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsAuditSshArgs
        {
            CommandLogging = false,
        },
        BisoAdminControls = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsBisoAdminControlsArgs
        {
            DisableClipboardRedirection = false,
            DisableCopyPaste = false,
            DisableDownload = false,
            DisableKeyboard = false,
            DisablePrinting = false,
            DisableUpload = false,
        },
        BlockPageEnabled = false,
        BlockPageReason = "string",
        BypassParentRule = false,
        CheckSession = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsCheckSessionArgs
        {
            Duration = "string",
            Enforce = false,
        },
        DnsResolvers = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversArgs
        {
            Ipv4s = new[]
            {
                new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4Args
                {
                    Ip = "string",
                    Port = 0,
                    RouteThroughPrivateNetwork = false,
                    VnetId = "string",
                },
            },
            Ipv6s = new[]
            {
                new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6Args
                {
                    Ip = "string",
                    Port = 0,
                    RouteThroughPrivateNetwork = false,
                    VnetId = "string",
                },
            },
        },
        Egress = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsEgressArgs
        {
            Ipv4 = "string",
            Ipv6 = "string",
            Ipv4Fallback = "string",
        },
        IgnoreCnameCategoryMatches = false,
        InsecureDisableDnssecValidation = false,
        IpCategories = false,
        L4override = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsL4overrideArgs
        {
            Ip = "string",
            Port = 0,
        },
        NotificationSettings = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsNotificationSettingsArgs
        {
            Enabled = false,
            Message = "string",
            SupportUrl = "string",
        },
        OverrideHost = "string",
        OverrideIps = new[]
        {
            "string",
        },
        PayloadLog = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsPayloadLogArgs
        {
            Enabled = false,
        },
        ResolveDnsInternally = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternallyArgs
        {
            Fallback = "string",
            ViewId = "string",
        },
        ResolveDnsThroughCloudflare = false,
        UntrustedCert = new Cloudflare.Inputs.ZeroTrustGatewayPolicyRuleSettingsUntrustedCertArgs
        {
            Action = "string",
        },
    },
    Traffic = "string",
});
Copy
example, err := cloudflare.NewZeroTrustGatewayPolicy(ctx, "zeroTrustGatewayPolicyResource", &cloudflare.ZeroTrustGatewayPolicyArgs{
	AccountId:     pulumi.String("string"),
	Action:        pulumi.String("string"),
	Description:   pulumi.String("string"),
	Name:          pulumi.String("string"),
	Precedence:    pulumi.Int(0),
	DevicePosture: pulumi.String("string"),
	Enabled:       pulumi.Bool(false),
	Filters: pulumi.StringArray{
		pulumi.String("string"),
	},
	Identity: pulumi.String("string"),
	RuleSettings: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsArgs{
		AddHeaders: pulumi.StringMap{
			"string": pulumi.String("string"),
		},
		AllowChildBypass: pulumi.Bool(false),
		AuditSsh: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsAuditSshArgs{
			CommandLogging: pulumi.Bool(false),
		},
		BisoAdminControls: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsBisoAdminControlsArgs{
			DisableClipboardRedirection: pulumi.Bool(false),
			DisableCopyPaste:            pulumi.Bool(false),
			DisableDownload:             pulumi.Bool(false),
			DisableKeyboard:             pulumi.Bool(false),
			DisablePrinting:             pulumi.Bool(false),
			DisableUpload:               pulumi.Bool(false),
		},
		BlockPageEnabled: pulumi.Bool(false),
		BlockPageReason:  pulumi.String("string"),
		BypassParentRule: pulumi.Bool(false),
		CheckSession: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsCheckSessionArgs{
			Duration: pulumi.String("string"),
			Enforce:  pulumi.Bool(false),
		},
		DnsResolvers: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsDnsResolversArgs{
			Ipv4s: cloudflare.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4Array{
				&cloudflare.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4Args{
					Ip:                         pulumi.String("string"),
					Port:                       pulumi.Int(0),
					RouteThroughPrivateNetwork: pulumi.Bool(false),
					VnetId:                     pulumi.String("string"),
				},
			},
			Ipv6s: cloudflare.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6Array{
				&cloudflare.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6Args{
					Ip:                         pulumi.String("string"),
					Port:                       pulumi.Int(0),
					RouteThroughPrivateNetwork: pulumi.Bool(false),
					VnetId:                     pulumi.String("string"),
				},
			},
		},
		Egress: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsEgressArgs{
			Ipv4:         pulumi.String("string"),
			Ipv6:         pulumi.String("string"),
			Ipv4Fallback: pulumi.String("string"),
		},
		IgnoreCnameCategoryMatches:      pulumi.Bool(false),
		InsecureDisableDnssecValidation: pulumi.Bool(false),
		IpCategories:                    pulumi.Bool(false),
		L4override: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsL4overrideArgs{
			Ip:   pulumi.String("string"),
			Port: pulumi.Int(0),
		},
		NotificationSettings: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsNotificationSettingsArgs{
			Enabled:    pulumi.Bool(false),
			Message:    pulumi.String("string"),
			SupportUrl: pulumi.String("string"),
		},
		OverrideHost: pulumi.String("string"),
		OverrideIps: pulumi.StringArray{
			pulumi.String("string"),
		},
		PayloadLog: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsPayloadLogArgs{
			Enabled: pulumi.Bool(false),
		},
		ResolveDnsInternally: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternallyArgs{
			Fallback: pulumi.String("string"),
			ViewId:   pulumi.String("string"),
		},
		ResolveDnsThroughCloudflare: pulumi.Bool(false),
		UntrustedCert: &cloudflare.ZeroTrustGatewayPolicyRuleSettingsUntrustedCertArgs{
			Action: pulumi.String("string"),
		},
	},
	Traffic: pulumi.String("string"),
})
Copy
var zeroTrustGatewayPolicyResource = new ZeroTrustGatewayPolicy("zeroTrustGatewayPolicyResource", ZeroTrustGatewayPolicyArgs.builder()
    .accountId("string")
    .action("string")
    .description("string")
    .name("string")
    .precedence(0)
    .devicePosture("string")
    .enabled(false)
    .filters("string")
    .identity("string")
    .ruleSettings(ZeroTrustGatewayPolicyRuleSettingsArgs.builder()
        .addHeaders(Map.of("string", "string"))
        .allowChildBypass(false)
        .auditSsh(ZeroTrustGatewayPolicyRuleSettingsAuditSshArgs.builder()
            .commandLogging(false)
            .build())
        .bisoAdminControls(ZeroTrustGatewayPolicyRuleSettingsBisoAdminControlsArgs.builder()
            .disableClipboardRedirection(false)
            .disableCopyPaste(false)
            .disableDownload(false)
            .disableKeyboard(false)
            .disablePrinting(false)
            .disableUpload(false)
            .build())
        .blockPageEnabled(false)
        .blockPageReason("string")
        .bypassParentRule(false)
        .checkSession(ZeroTrustGatewayPolicyRuleSettingsCheckSessionArgs.builder()
            .duration("string")
            .enforce(false)
            .build())
        .dnsResolvers(ZeroTrustGatewayPolicyRuleSettingsDnsResolversArgs.builder()
            .ipv4s(ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4Args.builder()
                .ip("string")
                .port(0)
                .routeThroughPrivateNetwork(false)
                .vnetId("string")
                .build())
            .ipv6s(ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6Args.builder()
                .ip("string")
                .port(0)
                .routeThroughPrivateNetwork(false)
                .vnetId("string")
                .build())
            .build())
        .egress(ZeroTrustGatewayPolicyRuleSettingsEgressArgs.builder()
            .ipv4("string")
            .ipv6("string")
            .ipv4Fallback("string")
            .build())
        .ignoreCnameCategoryMatches(false)
        .insecureDisableDnssecValidation(false)
        .ipCategories(false)
        .l4override(ZeroTrustGatewayPolicyRuleSettingsL4overrideArgs.builder()
            .ip("string")
            .port(0)
            .build())
        .notificationSettings(ZeroTrustGatewayPolicyRuleSettingsNotificationSettingsArgs.builder()
            .enabled(false)
            .message("string")
            .supportUrl("string")
            .build())
        .overrideHost("string")
        .overrideIps("string")
        .payloadLog(ZeroTrustGatewayPolicyRuleSettingsPayloadLogArgs.builder()
            .enabled(false)
            .build())
        .resolveDnsInternally(ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternallyArgs.builder()
            .fallback("string")
            .viewId("string")
            .build())
        .resolveDnsThroughCloudflare(false)
        .untrustedCert(ZeroTrustGatewayPolicyRuleSettingsUntrustedCertArgs.builder()
            .action("string")
            .build())
        .build())
    .traffic("string")
    .build());
Copy
zero_trust_gateway_policy_resource = cloudflare.ZeroTrustGatewayPolicy("zeroTrustGatewayPolicyResource",
    account_id="string",
    action="string",
    description="string",
    name="string",
    precedence=0,
    device_posture="string",
    enabled=False,
    filters=["string"],
    identity="string",
    rule_settings={
        "add_headers": {
            "string": "string",
        },
        "allow_child_bypass": False,
        "audit_ssh": {
            "command_logging": False,
        },
        "biso_admin_controls": {
            "disable_clipboard_redirection": False,
            "disable_copy_paste": False,
            "disable_download": False,
            "disable_keyboard": False,
            "disable_printing": False,
            "disable_upload": False,
        },
        "block_page_enabled": False,
        "block_page_reason": "string",
        "bypass_parent_rule": False,
        "check_session": {
            "duration": "string",
            "enforce": False,
        },
        "dns_resolvers": {
            "ipv4s": [{
                "ip": "string",
                "port": 0,
                "route_through_private_network": False,
                "vnet_id": "string",
            }],
            "ipv6s": [{
                "ip": "string",
                "port": 0,
                "route_through_private_network": False,
                "vnet_id": "string",
            }],
        },
        "egress": {
            "ipv4": "string",
            "ipv6": "string",
            "ipv4_fallback": "string",
        },
        "ignore_cname_category_matches": False,
        "insecure_disable_dnssec_validation": False,
        "ip_categories": False,
        "l4override": {
            "ip": "string",
            "port": 0,
        },
        "notification_settings": {
            "enabled": False,
            "message": "string",
            "support_url": "string",
        },
        "override_host": "string",
        "override_ips": ["string"],
        "payload_log": {
            "enabled": False,
        },
        "resolve_dns_internally": {
            "fallback": "string",
            "view_id": "string",
        },
        "resolve_dns_through_cloudflare": False,
        "untrusted_cert": {
            "action": "string",
        },
    },
    traffic="string")
Copy
const zeroTrustGatewayPolicyResource = new cloudflare.ZeroTrustGatewayPolicy("zeroTrustGatewayPolicyResource", {
    accountId: "string",
    action: "string",
    description: "string",
    name: "string",
    precedence: 0,
    devicePosture: "string",
    enabled: false,
    filters: ["string"],
    identity: "string",
    ruleSettings: {
        addHeaders: {
            string: "string",
        },
        allowChildBypass: false,
        auditSsh: {
            commandLogging: false,
        },
        bisoAdminControls: {
            disableClipboardRedirection: false,
            disableCopyPaste: false,
            disableDownload: false,
            disableKeyboard: false,
            disablePrinting: false,
            disableUpload: false,
        },
        blockPageEnabled: false,
        blockPageReason: "string",
        bypassParentRule: false,
        checkSession: {
            duration: "string",
            enforce: false,
        },
        dnsResolvers: {
            ipv4s: [{
                ip: "string",
                port: 0,
                routeThroughPrivateNetwork: false,
                vnetId: "string",
            }],
            ipv6s: [{
                ip: "string",
                port: 0,
                routeThroughPrivateNetwork: false,
                vnetId: "string",
            }],
        },
        egress: {
            ipv4: "string",
            ipv6: "string",
            ipv4Fallback: "string",
        },
        ignoreCnameCategoryMatches: false,
        insecureDisableDnssecValidation: false,
        ipCategories: false,
        l4override: {
            ip: "string",
            port: 0,
        },
        notificationSettings: {
            enabled: false,
            message: "string",
            supportUrl: "string",
        },
        overrideHost: "string",
        overrideIps: ["string"],
        payloadLog: {
            enabled: false,
        },
        resolveDnsInternally: {
            fallback: "string",
            viewId: "string",
        },
        resolveDnsThroughCloudflare: false,
        untrustedCert: {
            action: "string",
        },
    },
    traffic: "string",
});
Copy
type: cloudflare:ZeroTrustGatewayPolicy
properties:
    accountId: string
    action: string
    description: string
    devicePosture: string
    enabled: false
    filters:
        - string
    identity: string
    name: string
    precedence: 0
    ruleSettings:
        addHeaders:
            string: string
        allowChildBypass: false
        auditSsh:
            commandLogging: false
        bisoAdminControls:
            disableClipboardRedirection: false
            disableCopyPaste: false
            disableDownload: false
            disableKeyboard: false
            disablePrinting: false
            disableUpload: false
        blockPageEnabled: false
        blockPageReason: string
        bypassParentRule: false
        checkSession:
            duration: string
            enforce: false
        dnsResolvers:
            ipv4s:
                - ip: string
                  port: 0
                  routeThroughPrivateNetwork: false
                  vnetId: string
            ipv6s:
                - ip: string
                  port: 0
                  routeThroughPrivateNetwork: false
                  vnetId: string
        egress:
            ipv4: string
            ipv4Fallback: string
            ipv6: string
        ignoreCnameCategoryMatches: false
        insecureDisableDnssecValidation: false
        ipCategories: false
        l4override:
            ip: string
            port: 0
        notificationSettings:
            enabled: false
            message: string
            supportUrl: string
        overrideHost: string
        overrideIps:
            - string
        payloadLog:
            enabled: false
        resolveDnsInternally:
            fallback: string
            viewId: string
        resolveDnsThroughCloudflare: false
        untrustedCert:
            action: string
    traffic: string
Copy

ZeroTrustGatewayPolicy Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The ZeroTrustGatewayPolicy resource accepts the following input properties:

AccountId This property is required. string
The account identifier to target for the resource.
Action This property is required. string
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
Description This property is required. string
The description of the teams rule.
Name This property is required. string
The name of the teams rule.
Precedence This property is required. int
The evaluation precedence of the teams rule.
DevicePosture string
The wirefilter expression to be used for device_posture check matching.
Enabled bool
Indicator of rule enablement.
Filters List<string>
The protocol or layer to evaluate the traffic and identity expressions.
Identity string
The wirefilter expression to be used for identity matching.
RuleSettings ZeroTrustGatewayPolicyRuleSettings
Additional rule settings.
Traffic string
The wirefilter expression to be used for traffic matching.
AccountId This property is required. string
The account identifier to target for the resource.
Action This property is required. string
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
Description This property is required. string
The description of the teams rule.
Name This property is required. string
The name of the teams rule.
Precedence This property is required. int
The evaluation precedence of the teams rule.
DevicePosture string
The wirefilter expression to be used for device_posture check matching.
Enabled bool
Indicator of rule enablement.
Filters []string
The protocol or layer to evaluate the traffic and identity expressions.
Identity string
The wirefilter expression to be used for identity matching.
RuleSettings ZeroTrustGatewayPolicyRuleSettingsArgs
Additional rule settings.
Traffic string
The wirefilter expression to be used for traffic matching.
accountId This property is required. String
The account identifier to target for the resource.
action This property is required. String
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description This property is required. String
The description of the teams rule.
name This property is required. String
The name of the teams rule.
precedence This property is required. Integer
The evaluation precedence of the teams rule.
devicePosture String
The wirefilter expression to be used for device_posture check matching.
enabled Boolean
Indicator of rule enablement.
filters List<String>
The protocol or layer to evaluate the traffic and identity expressions.
identity String
The wirefilter expression to be used for identity matching.
ruleSettings ZeroTrustGatewayPolicyRuleSettings
Additional rule settings.
traffic String
The wirefilter expression to be used for traffic matching.
accountId This property is required. string
The account identifier to target for the resource.
action This property is required. string
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description This property is required. string
The description of the teams rule.
name This property is required. string
The name of the teams rule.
precedence This property is required. number
The evaluation precedence of the teams rule.
devicePosture string
The wirefilter expression to be used for device_posture check matching.
enabled boolean
Indicator of rule enablement.
filters string[]
The protocol or layer to evaluate the traffic and identity expressions.
identity string
The wirefilter expression to be used for identity matching.
ruleSettings ZeroTrustGatewayPolicyRuleSettings
Additional rule settings.
traffic string
The wirefilter expression to be used for traffic matching.
account_id This property is required. str
The account identifier to target for the resource.
action This property is required. str
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description This property is required. str
The description of the teams rule.
name This property is required. str
The name of the teams rule.
precedence This property is required. int
The evaluation precedence of the teams rule.
device_posture str
The wirefilter expression to be used for device_posture check matching.
enabled bool
Indicator of rule enablement.
filters Sequence[str]
The protocol or layer to evaluate the traffic and identity expressions.
identity str
The wirefilter expression to be used for identity matching.
rule_settings ZeroTrustGatewayPolicyRuleSettingsArgs
Additional rule settings.
traffic str
The wirefilter expression to be used for traffic matching.
accountId This property is required. String
The account identifier to target for the resource.
action This property is required. String
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description This property is required. String
The description of the teams rule.
name This property is required. String
The name of the teams rule.
precedence This property is required. Number
The evaluation precedence of the teams rule.
devicePosture String
The wirefilter expression to be used for device_posture check matching.
enabled Boolean
Indicator of rule enablement.
filters List<String>
The protocol or layer to evaluate the traffic and identity expressions.
identity String
The wirefilter expression to be used for identity matching.
ruleSettings Property Map
Additional rule settings.
traffic String
The wirefilter expression to be used for traffic matching.

Outputs

All input properties are implicitly available as output properties. Additionally, the ZeroTrustGatewayPolicy resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Version int
Id string
The provider-assigned unique ID for this managed resource.
Version int
id String
The provider-assigned unique ID for this managed resource.
version Integer
id string
The provider-assigned unique ID for this managed resource.
version number
id str
The provider-assigned unique ID for this managed resource.
version int
id String
The provider-assigned unique ID for this managed resource.
version Number

Look up Existing ZeroTrustGatewayPolicy Resource

Get an existing ZeroTrustGatewayPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ZeroTrustGatewayPolicyState, opts?: CustomResourceOptions): ZeroTrustGatewayPolicy
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        action: Optional[str] = None,
        description: Optional[str] = None,
        device_posture: Optional[str] = None,
        enabled: Optional[bool] = None,
        filters: Optional[Sequence[str]] = None,
        identity: Optional[str] = None,
        name: Optional[str] = None,
        precedence: Optional[int] = None,
        rule_settings: Optional[ZeroTrustGatewayPolicyRuleSettingsArgs] = None,
        traffic: Optional[str] = None,
        version: Optional[int] = None) -> ZeroTrustGatewayPolicy
func GetZeroTrustGatewayPolicy(ctx *Context, name string, id IDInput, state *ZeroTrustGatewayPolicyState, opts ...ResourceOption) (*ZeroTrustGatewayPolicy, error)
public static ZeroTrustGatewayPolicy Get(string name, Input<string> id, ZeroTrustGatewayPolicyState? state, CustomResourceOptions? opts = null)
public static ZeroTrustGatewayPolicy get(String name, Output<String> id, ZeroTrustGatewayPolicyState state, CustomResourceOptions options)
resources:  _:    type: cloudflare:ZeroTrustGatewayPolicy    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
AccountId string
The account identifier to target for the resource.
Action string
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
Description string
The description of the teams rule.
DevicePosture string
The wirefilter expression to be used for device_posture check matching.
Enabled bool
Indicator of rule enablement.
Filters List<string>
The protocol or layer to evaluate the traffic and identity expressions.
Identity string
The wirefilter expression to be used for identity matching.
Name string
The name of the teams rule.
Precedence int
The evaluation precedence of the teams rule.
RuleSettings ZeroTrustGatewayPolicyRuleSettings
Additional rule settings.
Traffic string
The wirefilter expression to be used for traffic matching.
Version int
AccountId string
The account identifier to target for the resource.
Action string
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
Description string
The description of the teams rule.
DevicePosture string
The wirefilter expression to be used for device_posture check matching.
Enabled bool
Indicator of rule enablement.
Filters []string
The protocol or layer to evaluate the traffic and identity expressions.
Identity string
The wirefilter expression to be used for identity matching.
Name string
The name of the teams rule.
Precedence int
The evaluation precedence of the teams rule.
RuleSettings ZeroTrustGatewayPolicyRuleSettingsArgs
Additional rule settings.
Traffic string
The wirefilter expression to be used for traffic matching.
Version int
accountId String
The account identifier to target for the resource.
action String
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description String
The description of the teams rule.
devicePosture String
The wirefilter expression to be used for device_posture check matching.
enabled Boolean
Indicator of rule enablement.
filters List<String>
The protocol or layer to evaluate the traffic and identity expressions.
identity String
The wirefilter expression to be used for identity matching.
name String
The name of the teams rule.
precedence Integer
The evaluation precedence of the teams rule.
ruleSettings ZeroTrustGatewayPolicyRuleSettings
Additional rule settings.
traffic String
The wirefilter expression to be used for traffic matching.
version Integer
accountId string
The account identifier to target for the resource.
action string
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description string
The description of the teams rule.
devicePosture string
The wirefilter expression to be used for device_posture check matching.
enabled boolean
Indicator of rule enablement.
filters string[]
The protocol or layer to evaluate the traffic and identity expressions.
identity string
The wirefilter expression to be used for identity matching.
name string
The name of the teams rule.
precedence number
The evaluation precedence of the teams rule.
ruleSettings ZeroTrustGatewayPolicyRuleSettings
Additional rule settings.
traffic string
The wirefilter expression to be used for traffic matching.
version number
account_id str
The account identifier to target for the resource.
action str
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description str
The description of the teams rule.
device_posture str
The wirefilter expression to be used for device_posture check matching.
enabled bool
Indicator of rule enablement.
filters Sequence[str]
The protocol or layer to evaluate the traffic and identity expressions.
identity str
The wirefilter expression to be used for identity matching.
name str
The name of the teams rule.
precedence int
The evaluation precedence of the teams rule.
rule_settings ZeroTrustGatewayPolicyRuleSettingsArgs
Additional rule settings.
traffic str
The wirefilter expression to be used for traffic matching.
version int
accountId String
The account identifier to target for the resource.
action String
The action executed by matched teams rule. Available values: allow, block, safesearch, ytrestricted, on, off, scan, noscan, isolate, noisolate, override, l4_override, egress, audit_ssh, resolve.
description String
The description of the teams rule.
devicePosture String
The wirefilter expression to be used for device_posture check matching.
enabled Boolean
Indicator of rule enablement.
filters List<String>
The protocol or layer to evaluate the traffic and identity expressions.
identity String
The wirefilter expression to be used for identity matching.
name String
The name of the teams rule.
precedence Number
The evaluation precedence of the teams rule.
ruleSettings Property Map
Additional rule settings.
traffic String
The wirefilter expression to be used for traffic matching.
version Number

Supporting Types

ZeroTrustGatewayPolicyRuleSettings
, ZeroTrustGatewayPolicyRuleSettingsArgs

AddHeaders Dictionary<string, string>
Add custom headers to allowed requests in the form of key-value pairs.
AllowChildBypass bool
Allow parent MSP accounts to enable bypass their children's rules.
AuditSsh ZeroTrustGatewayPolicyRuleSettingsAuditSsh
Settings for auditing SSH usage.
BisoAdminControls ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls
Configure how browser isolation behaves.
BlockPageEnabled bool
Indicator of block page enablement.
BlockPageReason string
The displayed reason for a user being blocked.
BypassParentRule bool
Allow child MSP accounts to bypass their parent's rule.
CheckSession ZeroTrustGatewayPolicyRuleSettingsCheckSession
Configure how session check behaves.
DnsResolvers ZeroTrustGatewayPolicyRuleSettingsDnsResolvers
Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when resolvednsthrough*cloudflare is set. DNS queries will route to the address closest to their origin.
Egress ZeroTrustGatewayPolicyRuleSettingsEgress
Configure how Proxy traffic egresses. Can be set for rules with Egress action and Egress filter. Can be omitted to indicate local egress via Warp IPs.
IgnoreCnameCategoryMatches bool
Set to true, to ignore the category matches at CNAME domains in a response.
InsecureDisableDnssecValidation bool
Disable DNSSEC validation (must be Allow rule).
IpCategories bool
Turns on IP category based filter on dns if the rule contains dns category checks.
L4override ZeroTrustGatewayPolicyRuleSettingsL4override
Settings to forward layer 4 traffic.
NotificationSettings ZeroTrustGatewayPolicyRuleSettingsNotificationSettings
Notification settings on a block rule.
OverrideHost string
The host to override matching DNS queries with.
OverrideIps List<string>
The IPs to override matching DNS queries with.
PayloadLog ZeroTrustGatewayPolicyRuleSettingsPayloadLog
Configure DLP Payload Logging settings for this rule.
ResolveDnsInternally ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally
Configure to forward the query to the internal DNS service, passing the specified 'viewid' as input. Cannot be set when 'dnsresolvers' are specified or 'resolvednsthrough*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
ResolveDnsThroughCloudflare bool
Enable sending queries that match the resolver policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when dns_resolvers are specified.
UntrustedCert ZeroTrustGatewayPolicyRuleSettingsUntrustedCert
Configure untrusted certificate settings for this rule.
AddHeaders map[string]string
Add custom headers to allowed requests in the form of key-value pairs.
AllowChildBypass bool
Allow parent MSP accounts to enable bypass their children's rules.
AuditSsh ZeroTrustGatewayPolicyRuleSettingsAuditSsh
Settings for auditing SSH usage.
BisoAdminControls ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls
Configure how browser isolation behaves.
BlockPageEnabled bool
Indicator of block page enablement.
BlockPageReason string
The displayed reason for a user being blocked.
BypassParentRule bool
Allow child MSP accounts to bypass their parent's rule.
CheckSession ZeroTrustGatewayPolicyRuleSettingsCheckSession
Configure how session check behaves.
DnsResolvers ZeroTrustGatewayPolicyRuleSettingsDnsResolvers
Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when resolvednsthrough*cloudflare is set. DNS queries will route to the address closest to their origin.
Egress ZeroTrustGatewayPolicyRuleSettingsEgress
Configure how Proxy traffic egresses. Can be set for rules with Egress action and Egress filter. Can be omitted to indicate local egress via Warp IPs.
IgnoreCnameCategoryMatches bool
Set to true, to ignore the category matches at CNAME domains in a response.
InsecureDisableDnssecValidation bool
Disable DNSSEC validation (must be Allow rule).
IpCategories bool
Turns on IP category based filter on dns if the rule contains dns category checks.
L4override ZeroTrustGatewayPolicyRuleSettingsL4override
Settings to forward layer 4 traffic.
NotificationSettings ZeroTrustGatewayPolicyRuleSettingsNotificationSettings
Notification settings on a block rule.
OverrideHost string
The host to override matching DNS queries with.
OverrideIps []string
The IPs to override matching DNS queries with.
PayloadLog ZeroTrustGatewayPolicyRuleSettingsPayloadLog
Configure DLP Payload Logging settings for this rule.
ResolveDnsInternally ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally
Configure to forward the query to the internal DNS service, passing the specified 'viewid' as input. Cannot be set when 'dnsresolvers' are specified or 'resolvednsthrough*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
ResolveDnsThroughCloudflare bool
Enable sending queries that match the resolver policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when dns_resolvers are specified.
UntrustedCert ZeroTrustGatewayPolicyRuleSettingsUntrustedCert
Configure untrusted certificate settings for this rule.
addHeaders Map<String,String>
Add custom headers to allowed requests in the form of key-value pairs.
allowChildBypass Boolean
Allow parent MSP accounts to enable bypass their children's rules.
auditSsh ZeroTrustGatewayPolicyRuleSettingsAuditSsh
Settings for auditing SSH usage.
bisoAdminControls ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls
Configure how browser isolation behaves.
blockPageEnabled Boolean
Indicator of block page enablement.
blockPageReason String
The displayed reason for a user being blocked.
bypassParentRule Boolean
Allow child MSP accounts to bypass their parent's rule.
checkSession ZeroTrustGatewayPolicyRuleSettingsCheckSession
Configure how session check behaves.
dnsResolvers ZeroTrustGatewayPolicyRuleSettingsDnsResolvers
Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when resolvednsthrough*cloudflare is set. DNS queries will route to the address closest to their origin.
egress ZeroTrustGatewayPolicyRuleSettingsEgress
Configure how Proxy traffic egresses. Can be set for rules with Egress action and Egress filter. Can be omitted to indicate local egress via Warp IPs.
ignoreCnameCategoryMatches Boolean
Set to true, to ignore the category matches at CNAME domains in a response.
insecureDisableDnssecValidation Boolean
Disable DNSSEC validation (must be Allow rule).
ipCategories Boolean
Turns on IP category based filter on dns if the rule contains dns category checks.
l4override ZeroTrustGatewayPolicyRuleSettingsL4override
Settings to forward layer 4 traffic.
notificationSettings ZeroTrustGatewayPolicyRuleSettingsNotificationSettings
Notification settings on a block rule.
overrideHost String
The host to override matching DNS queries with.
overrideIps List<String>
The IPs to override matching DNS queries with.
payloadLog ZeroTrustGatewayPolicyRuleSettingsPayloadLog
Configure DLP Payload Logging settings for this rule.
resolveDnsInternally ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally
Configure to forward the query to the internal DNS service, passing the specified 'viewid' as input. Cannot be set when 'dnsresolvers' are specified or 'resolvednsthrough*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
resolveDnsThroughCloudflare Boolean
Enable sending queries that match the resolver policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when dns_resolvers are specified.
untrustedCert ZeroTrustGatewayPolicyRuleSettingsUntrustedCert
Configure untrusted certificate settings for this rule.
addHeaders {[key: string]: string}
Add custom headers to allowed requests in the form of key-value pairs.
allowChildBypass boolean
Allow parent MSP accounts to enable bypass their children's rules.
auditSsh ZeroTrustGatewayPolicyRuleSettingsAuditSsh
Settings for auditing SSH usage.
bisoAdminControls ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls
Configure how browser isolation behaves.
blockPageEnabled boolean
Indicator of block page enablement.
blockPageReason string
The displayed reason for a user being blocked.
bypassParentRule boolean
Allow child MSP accounts to bypass their parent's rule.
checkSession ZeroTrustGatewayPolicyRuleSettingsCheckSession
Configure how session check behaves.
dnsResolvers ZeroTrustGatewayPolicyRuleSettingsDnsResolvers
Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when resolvednsthrough*cloudflare is set. DNS queries will route to the address closest to their origin.
egress ZeroTrustGatewayPolicyRuleSettingsEgress
Configure how Proxy traffic egresses. Can be set for rules with Egress action and Egress filter. Can be omitted to indicate local egress via Warp IPs.
ignoreCnameCategoryMatches boolean
Set to true, to ignore the category matches at CNAME domains in a response.
insecureDisableDnssecValidation boolean
Disable DNSSEC validation (must be Allow rule).
ipCategories boolean
Turns on IP category based filter on dns if the rule contains dns category checks.
l4override ZeroTrustGatewayPolicyRuleSettingsL4override
Settings to forward layer 4 traffic.
notificationSettings ZeroTrustGatewayPolicyRuleSettingsNotificationSettings
Notification settings on a block rule.
overrideHost string
The host to override matching DNS queries with.
overrideIps string[]
The IPs to override matching DNS queries with.
payloadLog ZeroTrustGatewayPolicyRuleSettingsPayloadLog
Configure DLP Payload Logging settings for this rule.
resolveDnsInternally ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally
Configure to forward the query to the internal DNS service, passing the specified 'viewid' as input. Cannot be set when 'dnsresolvers' are specified or 'resolvednsthrough*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
resolveDnsThroughCloudflare boolean
Enable sending queries that match the resolver policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when dns_resolvers are specified.
untrustedCert ZeroTrustGatewayPolicyRuleSettingsUntrustedCert
Configure untrusted certificate settings for this rule.
add_headers Mapping[str, str]
Add custom headers to allowed requests in the form of key-value pairs.
allow_child_bypass bool
Allow parent MSP accounts to enable bypass their children's rules.
audit_ssh ZeroTrustGatewayPolicyRuleSettingsAuditSsh
Settings for auditing SSH usage.
biso_admin_controls ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls
Configure how browser isolation behaves.
block_page_enabled bool
Indicator of block page enablement.
block_page_reason str
The displayed reason for a user being blocked.
bypass_parent_rule bool
Allow child MSP accounts to bypass their parent's rule.
check_session ZeroTrustGatewayPolicyRuleSettingsCheckSession
Configure how session check behaves.
dns_resolvers ZeroTrustGatewayPolicyRuleSettingsDnsResolvers
Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when resolvednsthrough*cloudflare is set. DNS queries will route to the address closest to their origin.
egress ZeroTrustGatewayPolicyRuleSettingsEgress
Configure how Proxy traffic egresses. Can be set for rules with Egress action and Egress filter. Can be omitted to indicate local egress via Warp IPs.
ignore_cname_category_matches bool
Set to true, to ignore the category matches at CNAME domains in a response.
insecure_disable_dnssec_validation bool
Disable DNSSEC validation (must be Allow rule).
ip_categories bool
Turns on IP category based filter on dns if the rule contains dns category checks.
l4override ZeroTrustGatewayPolicyRuleSettingsL4override
Settings to forward layer 4 traffic.
notification_settings ZeroTrustGatewayPolicyRuleSettingsNotificationSettings
Notification settings on a block rule.
override_host str
The host to override matching DNS queries with.
override_ips Sequence[str]
The IPs to override matching DNS queries with.
payload_log ZeroTrustGatewayPolicyRuleSettingsPayloadLog
Configure DLP Payload Logging settings for this rule.
resolve_dns_internally ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally
Configure to forward the query to the internal DNS service, passing the specified 'viewid' as input. Cannot be set when 'dnsresolvers' are specified or 'resolvednsthrough*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
resolve_dns_through_cloudflare bool
Enable sending queries that match the resolver policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when dns_resolvers are specified.
untrusted_cert ZeroTrustGatewayPolicyRuleSettingsUntrustedCert
Configure untrusted certificate settings for this rule.
addHeaders Map<String>
Add custom headers to allowed requests in the form of key-value pairs.
allowChildBypass Boolean
Allow parent MSP accounts to enable bypass their children's rules.
auditSsh Property Map
Settings for auditing SSH usage.
bisoAdminControls Property Map
Configure how browser isolation behaves.
blockPageEnabled Boolean
Indicator of block page enablement.
blockPageReason String
The displayed reason for a user being blocked.
bypassParentRule Boolean
Allow child MSP accounts to bypass their parent's rule.
checkSession Property Map
Configure how session check behaves.
dnsResolvers Property Map
Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when resolvednsthrough*cloudflare is set. DNS queries will route to the address closest to their origin.
egress Property Map
Configure how Proxy traffic egresses. Can be set for rules with Egress action and Egress filter. Can be omitted to indicate local egress via Warp IPs.
ignoreCnameCategoryMatches Boolean
Set to true, to ignore the category matches at CNAME domains in a response.
insecureDisableDnssecValidation Boolean
Disable DNSSEC validation (must be Allow rule).
ipCategories Boolean
Turns on IP category based filter on dns if the rule contains dns category checks.
l4override Property Map
Settings to forward layer 4 traffic.
notificationSettings Property Map
Notification settings on a block rule.
overrideHost String
The host to override matching DNS queries with.
overrideIps List<String>
The IPs to override matching DNS queries with.
payloadLog Property Map
Configure DLP Payload Logging settings for this rule.
resolveDnsInternally Property Map
Configure to forward the query to the internal DNS service, passing the specified 'viewid' as input. Cannot be set when 'dnsresolvers' are specified or 'resolvednsthrough*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
resolveDnsThroughCloudflare Boolean
Enable sending queries that match the resolver policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when dns_resolvers are specified.
untrustedCert Property Map
Configure untrusted certificate settings for this rule.

ZeroTrustGatewayPolicyRuleSettingsAuditSsh
, ZeroTrustGatewayPolicyRuleSettingsAuditSshArgs

CommandLogging This property is required. bool
Log all SSH commands.
CommandLogging This property is required. bool
Log all SSH commands.
commandLogging This property is required. Boolean
Log all SSH commands.
commandLogging This property is required. boolean
Log all SSH commands.
command_logging This property is required. bool
Log all SSH commands.
commandLogging This property is required. Boolean
Log all SSH commands.

ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls
, ZeroTrustGatewayPolicyRuleSettingsBisoAdminControlsArgs

DisableClipboardRedirection bool
Disable clipboard redirection.
DisableCopyPaste bool
Disable copy-paste.
DisableDownload bool
Disable download.
DisableKeyboard bool
Disable keyboard usage.
DisablePrinting bool
Disable printing.
DisableUpload bool
Disable upload.
DisableClipboardRedirection bool
Disable clipboard redirection.
DisableCopyPaste bool
Disable copy-paste.
DisableDownload bool
Disable download.
DisableKeyboard bool
Disable keyboard usage.
DisablePrinting bool
Disable printing.
DisableUpload bool
Disable upload.
disableClipboardRedirection Boolean
Disable clipboard redirection.
disableCopyPaste Boolean
Disable copy-paste.
disableDownload Boolean
Disable download.
disableKeyboard Boolean
Disable keyboard usage.
disablePrinting Boolean
Disable printing.
disableUpload Boolean
Disable upload.
disableClipboardRedirection boolean
Disable clipboard redirection.
disableCopyPaste boolean
Disable copy-paste.
disableDownload boolean
Disable download.
disableKeyboard boolean
Disable keyboard usage.
disablePrinting boolean
Disable printing.
disableUpload boolean
Disable upload.
disable_clipboard_redirection bool
Disable clipboard redirection.
disable_copy_paste bool
Disable copy-paste.
disable_download bool
Disable download.
disable_keyboard bool
Disable keyboard usage.
disable_printing bool
Disable printing.
disable_upload bool
Disable upload.
disableClipboardRedirection Boolean
Disable clipboard redirection.
disableCopyPaste Boolean
Disable copy-paste.
disableDownload Boolean
Disable download.
disableKeyboard Boolean
Disable keyboard usage.
disablePrinting Boolean
Disable printing.
disableUpload Boolean
Disable upload.

ZeroTrustGatewayPolicyRuleSettingsCheckSession
, ZeroTrustGatewayPolicyRuleSettingsCheckSessionArgs

Duration This property is required. string
Configure how fresh the session needs to be to be considered valid.
Enforce This property is required. bool
Enable session enforcement for this rule.
Duration This property is required. string
Configure how fresh the session needs to be to be considered valid.
Enforce This property is required. bool
Enable session enforcement for this rule.
duration This property is required. String
Configure how fresh the session needs to be to be considered valid.
enforce This property is required. Boolean
Enable session enforcement for this rule.
duration This property is required. string
Configure how fresh the session needs to be to be considered valid.
enforce This property is required. boolean
Enable session enforcement for this rule.
duration This property is required. str
Configure how fresh the session needs to be to be considered valid.
enforce This property is required. bool
Enable session enforcement for this rule.
duration This property is required. String
Configure how fresh the session needs to be to be considered valid.
enforce This property is required. Boolean
Enable session enforcement for this rule.

ZeroTrustGatewayPolicyRuleSettingsDnsResolvers
, ZeroTrustGatewayPolicyRuleSettingsDnsResolversArgs

ipv4s List<Property Map>
IPv4 resolvers.
ipv6s List<Property Map>
IPv6 resolvers.

ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4
, ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4Args

Ip This property is required. string
The IPv4 or IPv6 address of the upstream resolver.
Port int
A port number to use for the upstream resolver. Defaults to 53.
RouteThroughPrivateNetwork bool
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
VnetId string
specify a virtual network for this resolver. Uses default virtual network id if omitted.
Ip This property is required. string
The IPv4 or IPv6 address of the upstream resolver.
Port int
A port number to use for the upstream resolver. Defaults to 53.
RouteThroughPrivateNetwork bool
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
VnetId string
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. String
The IPv4 or IPv6 address of the upstream resolver.
port Integer
A port number to use for the upstream resolver. Defaults to 53.
routeThroughPrivateNetwork Boolean
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnetId String
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. string
The IPv4 or IPv6 address of the upstream resolver.
port number
A port number to use for the upstream resolver. Defaults to 53.
routeThroughPrivateNetwork boolean
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnetId string
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. str
The IPv4 or IPv6 address of the upstream resolver.
port int
A port number to use for the upstream resolver. Defaults to 53.
route_through_private_network bool
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnet_id str
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. String
The IPv4 or IPv6 address of the upstream resolver.
port Number
A port number to use for the upstream resolver. Defaults to 53.
routeThroughPrivateNetwork Boolean
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnetId String
specify a virtual network for this resolver. Uses default virtual network id if omitted.

ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6
, ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6Args

Ip This property is required. string
The IPv4 or IPv6 address of the upstream resolver.
Port int
A port number to use for the upstream resolver. Defaults to 53.
RouteThroughPrivateNetwork bool
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
VnetId string
specify a virtual network for this resolver. Uses default virtual network id if omitted.
Ip This property is required. string
The IPv4 or IPv6 address of the upstream resolver.
Port int
A port number to use for the upstream resolver. Defaults to 53.
RouteThroughPrivateNetwork bool
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
VnetId string
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. String
The IPv4 or IPv6 address of the upstream resolver.
port Integer
A port number to use for the upstream resolver. Defaults to 53.
routeThroughPrivateNetwork Boolean
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnetId String
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. string
The IPv4 or IPv6 address of the upstream resolver.
port number
A port number to use for the upstream resolver. Defaults to 53.
routeThroughPrivateNetwork boolean
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnetId string
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. str
The IPv4 or IPv6 address of the upstream resolver.
port int
A port number to use for the upstream resolver. Defaults to 53.
route_through_private_network bool
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnet_id str
specify a virtual network for this resolver. Uses default virtual network id if omitted.
ip This property is required. String
The IPv4 or IPv6 address of the upstream resolver.
port Number
A port number to use for the upstream resolver. Defaults to 53.
routeThroughPrivateNetwork Boolean
Whether to connect to this resolver over a private network. Must be set when vnet_id is set.
vnetId String
specify a virtual network for this resolver. Uses default virtual network id if omitted.

ZeroTrustGatewayPolicyRuleSettingsEgress
, ZeroTrustGatewayPolicyRuleSettingsEgressArgs

Ipv4 This property is required. string
The IPv4 address to be used for egress.
Ipv6 This property is required. string
The IPv6 range to be used for egress.
Ipv4Fallback string
The IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egreass via Warp IPs.
Ipv4 This property is required. string
The IPv4 address to be used for egress.
Ipv6 This property is required. string
The IPv6 range to be used for egress.
Ipv4Fallback string
The IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egreass via Warp IPs.
ipv4 This property is required. String
The IPv4 address to be used for egress.
ipv6 This property is required. String
The IPv6 range to be used for egress.
ipv4Fallback String
The IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egreass via Warp IPs.
ipv4 This property is required. string
The IPv4 address to be used for egress.
ipv6 This property is required. string
The IPv6 range to be used for egress.
ipv4Fallback string
The IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egreass via Warp IPs.
ipv4 This property is required. str
The IPv4 address to be used for egress.
ipv6 This property is required. str
The IPv6 range to be used for egress.
ipv4_fallback str
The IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egreass via Warp IPs.
ipv4 This property is required. String
The IPv4 address to be used for egress.
ipv6 This property is required. String
The IPv6 range to be used for egress.
ipv4Fallback String
The IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egreass via Warp IPs.

ZeroTrustGatewayPolicyRuleSettingsL4override
, ZeroTrustGatewayPolicyRuleSettingsL4overrideArgs

Ip This property is required. string
Override IP to forward traffic to.
Port This property is required. int
Override Port to forward traffic to.
Ip This property is required. string
Override IP to forward traffic to.
Port This property is required. int
Override Port to forward traffic to.
ip This property is required. String
Override IP to forward traffic to.
port This property is required. Integer
Override Port to forward traffic to.
ip This property is required. string
Override IP to forward traffic to.
port This property is required. number
Override Port to forward traffic to.
ip This property is required. str
Override IP to forward traffic to.
port This property is required. int
Override Port to forward traffic to.
ip This property is required. String
Override IP to forward traffic to.
port This property is required. Number
Override Port to forward traffic to.

ZeroTrustGatewayPolicyRuleSettingsNotificationSettings
, ZeroTrustGatewayPolicyRuleSettingsNotificationSettingsArgs

Enabled bool
Enable notification settings.
Message string
Notification content.
SupportUrl string
Support URL to show in the notification.
Enabled bool
Enable notification settings.
Message string
Notification content.
SupportUrl string
Support URL to show in the notification.
enabled Boolean
Enable notification settings.
message String
Notification content.
supportUrl String
Support URL to show in the notification.
enabled boolean
Enable notification settings.
message string
Notification content.
supportUrl string
Support URL to show in the notification.
enabled bool
Enable notification settings.
message str
Notification content.
support_url str
Support URL to show in the notification.
enabled Boolean
Enable notification settings.
message String
Notification content.
supportUrl String
Support URL to show in the notification.

ZeroTrustGatewayPolicyRuleSettingsPayloadLog
, ZeroTrustGatewayPolicyRuleSettingsPayloadLogArgs

Enabled This property is required. bool
Enable or disable DLP Payload Logging for this rule.
Enabled This property is required. bool
Enable or disable DLP Payload Logging for this rule.
enabled This property is required. Boolean
Enable or disable DLP Payload Logging for this rule.
enabled This property is required. boolean
Enable or disable DLP Payload Logging for this rule.
enabled This property is required. bool
Enable or disable DLP Payload Logging for this rule.
enabled This property is required. Boolean
Enable or disable DLP Payload Logging for this rule.

ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally
, ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternallyArgs

Fallback string
The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
ViewId string
The internal DNS view identifier that's passed to the internal DNS service.
Fallback string
The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
ViewId string
The internal DNS view identifier that's passed to the internal DNS service.
fallback String
The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
viewId String
The internal DNS view identifier that's passed to the internal DNS service.
fallback string
The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
viewId string
The internal DNS view identifier that's passed to the internal DNS service.
fallback str
The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
view_id str
The internal DNS view identifier that's passed to the internal DNS service.
fallback String
The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
viewId String
The internal DNS view identifier that's passed to the internal DNS service.

ZeroTrustGatewayPolicyRuleSettingsUntrustedCert
, ZeroTrustGatewayPolicyRuleSettingsUntrustedCertArgs

Action string
Action to be taken when the SSL certificate of upstream is invalid. Available values: pass_through, block, error.
Action string
Action to be taken when the SSL certificate of upstream is invalid. Available values: pass_through, block, error.
action String
Action to be taken when the SSL certificate of upstream is invalid. Available values: pass_through, block, error.
action string
Action to be taken when the SSL certificate of upstream is invalid. Available values: pass_through, block, error.
action str
Action to be taken when the SSL certificate of upstream is invalid. Available values: pass_through, block, error.
action String
Action to be taken when the SSL certificate of upstream is invalid. Available values: pass_through, block, error.

Import

$ pulumi import cloudflare:index/zeroTrustGatewayPolicy:ZeroTrustGatewayPolicy example <account_id>/<teams_rule_id>
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
Cloudflare pulumi/pulumi-cloudflare
License
Apache-2.0
Notes
This Pulumi package is based on the cloudflare Terraform Provider.
Cloudflare v5.49.1 published on Tuesday, Feb 18, 2025 by Pulumi
pulumi/pulumi-cloudflare