デバイス登録の権限を定義する

resource "cloudflare_zero_trust_access_policy" "allow_company_emails" {
	account_id   = var.cloudflare_account_id
	name         = "Allow company emails"
	decision     = "allow"
	include      = [
		{
			email_domain = {
				domain = "@example.com"
			}
		}
	]
}

resource "cloudflare_zero_trust_access_application" "device_enrollment" {
	account_id       = var.cloudflare_account_id
	type             = "warp"
	name             = "Warp device enrollment"
	allowed_idps              = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id]
	auto_redirect_to_identity = true
	app_launcher_visible      = false
	policies = [
		{
			id = cloudflare_zero_trust_access_policy.allow_company_emails.id
			precedence = 1
		}
	]
}

-----BEGIN CERTIFICATE-----
<intermediate.pem>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<rootCA.pem>
-----END CERTIFICATE-----

resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" {
	account_id     = var.cloudflare_account_id
	name           = "WARP enrollment mTLS cert"
	certificate    = <<EOT
	-----BEGIN CERTIFICATE-----
	xxxx
	xxxx
	-----END CERTIFICATE-----
	EOT
	associated_hostnames = ["your-team-name.cloudflareaccess.com"]
}

resource "cloudflare_zero_trust_access_policy" "warp_enrollment_mtls" {
	account_id     = var.cloudflare_account_id
	name           = "Allow employees with mTLS cert"
	decision       = "allow"
	include = [
		{
			email_domain = {
				domain = "@example.com"
			}
		}
	]

	require = [
		{
			common_name = {
				common_name = "Common name 1"
			}
		},
				{
			common_name = {
				common_name = "Common name 2"
			}
		}
	]
}