Terraform-provider-cloudflare: cloudflare-access_policy policyOptionElement is missing access groups

[AshleyPoole]

Affected Resource(s)

• cloudflare_access_policy

Expected Behavior

Within the cloudflare_access_policy resource, I expect that the "include" option (policyOptionElement) should also support "access groups" as per the UI.

Actual Behavior

Currently not supported. Only email, email domain, IP and everyone is supported.

Important Factoids

This is important for people who use access groups across multiple policies.

References

https://api.cloudflare.com/#access-policy-create-access-policy

Currently supported via API:
Match a specific email - Can be done via Terraform
Match an entire email domain - Can be done via Terraform
Match everyone - Can be done via Terraform
Match an IP address block - Can be done via Terraform
Match an Access Group - Cannot be done via Terraform. Proposing, at least this one option is added.
Match an Azure Group - Cannot be done via Terraform.
Match a Github Organization - Cannot be done via Terraform.
Match a GSuite Group - Cannot be done via Terraform.
Match an Okta Group - Cannot be done via Terraform.
Match a SAML Group - Cannot be done via Terraform.

[jacobbednarz]

The access groups API endpoints aren't publicly available yet so this will be pending those APIs being exposed. When they are available, a new resource will be introduced as access_group or similar.

[msheiny]

The access groups API endpoints aren't publicly available

OHhhh is that what that means @jacobbednarz ? I was perplexed why when we visit that API page the examples aren't showing up. I even opened this ticket on Cloudflare's discourse forum trying to figure out what is wrong. If description elements are empty on the cloudflare API that historically just means its not fully exposed yet?

[grrywlsn]

@jacobbednarz is it still the case that the access group API endpoints aren't publicly available? and if not, is there a timeline for when they might be?

[jacobbednarz]

hey @grrywlsn I've just come back from vacation and seen this along with service tokens are now in the public API so this is ready to be implemented. We use Access quite a bit internally so we'll be looking to add support soonish.

[purva1192]

I have similar question but for Okta Groups. Is there a way to support Okta groups in the access_policy? Should I open another ticket for this?

[jacobbednarz]

@purva1192 Support will be added for all publicly documented access groups which are available in Cloudflare when it comes to implementing it. Both Okta implementations are currently supported in the library. See https://github.com/cloudflare/cloudflare-go/blob/74099a0b421d4b49408df5f23b80cf265a5fe8a0/access_identity_provider.go#L115-L122

[purva1192]

@jacobbednarz Cloudflare supports Okta implementations. However, is there a way to provision Okta groups via Terraform. According to the docs, I could not see any way to include Okta groups in the access_policy.

[jbergknoff-rival]

Any movement on this?

[xens]

@jacobbednarz any news ? We're a paying customer and struggling with this one :)

[jacobbednarz]

@xens we’re also paying customers 😉 I’m not employed by Cloudflare, just maintain these as we have an invested interest in it.

Access isn’t my current focus for us so this won’t be on my radar for another couple of weeks but I’m happy to review and guide a PR for this seeing how it’s urgent for you if one is submitted.

[xens]

@jacobbednarz sorry for that ;) I'd be happy to contribute to that one, I'll check the API documentation and see what I can do.

[groodt]

I'm looking to add a cloudflare_access_policy for Okta. Should I raise a different issue?

I do think this is supported by the Cloudflare API:
https://api.cloudflare.com/#access-policy-update-access-policy

I've been able to retrieve a policy and the response looks like this:

❯ curl -X GET "https://api.cloudflare.com/client/v4/zones/$zoneid/access/apps/$appId/policies" \
       -H "Content-Type: application/json"
{
  "result": [
    {
      "created_at": "2020-01-29T04:44:24Z",
      "decision": "allow",
      "exclude": [],
      "id": "blah",
      "include": [
        {
          "okta": {
            "name": "group",
            "connection_id": "blah"
          }
        }
      ],
      "name": "blah",
      "precedence": 1,
      "require": [],
      "uid": "blah",
      "updated_at": "2020-01-29T04:44:24Z"
    }
  ],
  "success": true,
  "errors": [],
  "messages": []
}

Is the proposal here considering to expand the cloudflare_access_policy Condtions to accept conditions of the form:

  include {
    okta = ["group1", "group2"]
  }

or

  exclude {
    okta = ["group1", "group2"]
  }

That's all that is necessary for Okta support I believe.

When posting to the update API, those arrays need to be expanded to look similar to:

      "include": [
        {
          "okta": {
            "name": "group1",
          }
        },
        {
          "okta": {
            "name": "group2",
          }
        }
      ],

[vital4ik]

any news on this ? we are able to create access groups using terraform CF provider but we cant use them when creating policy. when will policy resource support access groups resources in include/exclude? I can also see examples for using groups in the API for policy creation in the documentation. this means that work on adding the functionality can happen any time?

[filipowm]

Configuring Access Groups is now supported by both Cloudflare (https://api.cloudflare.com/#access-policy-create-access-policy) and Cloudflare Go client (https://github.com/cloudflare/cloudflare-go/blob/master/access_policy.go#L82) that is used.

Based on above I've opened a PR that is adding support of Access Groups.

[estenrye]

@farberjd This is the issue I was referencing when we talked today.

[analytically]

Still no support for Okta groups it seems.