Step-by-Step Guide to Setting Up Cloudflare Access and Google Cloud IAP for Zero-Trust Remote Access

import os
import sys
import json
import logging
from google.auth.transport.requests import Request
from google.oauth2 import service_account
from googleapiclient.discovery import build
import requests

# Configure logging for audit trails
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.StreamHandler(sys.stdout)]
)
logger = logging.getLogger(__name__)

# Environment variable validation
REQUIRED_ENVS = [
    "GOOGLE_WORKSPACE_CUSTOMER_ID",
    "CLOUDFLARE_API_TOKEN",
    "GCP_PROJECT_ID",
    "GCP_SERVICE_ACCOUNT_KEY_PATH"
]

def validate_env_vars():
    """Check all required environment variables are set"""
    missing = [var for var in REQUIRED_ENVS if not os.getenv(var)]
    if missing:
        logger.error(f"Missing required environment variables: {missing}")
        sys.exit(1)
    logger.info("All environment variables validated")

def validate_google_workspace_idp():
    """Verify Google Workspace IdP is configured for OIDC"""
    try:
        creds = service_account.Credentials.from_service_account_file(
            os.getenv("GCP_SERVICE_ACCOUNT_KEY_PATH"),
            scopes=["https://www.googleapis.com/auth/admin.directory.user.readonly"]
        )
        # Impersonate Workspace admin to access Directory API
        delegated_creds = creds.with_subject(os.getenv("WORKSPACE_ADMIN_EMAIL"))
        service = build("admin", "directory_v1", credentials=delegated_creds)

        # Check if OIDC app is configured
        apps = service.users().list(domain=os.getenv("WORKSPACE_DOMAIN"), maxResults=1).execute()
        logger.info(f"Google Workspace user count: {apps.get('users', [])}")
        logger.info("Google Workspace IdP validated successfully")
    except Exception as e:
        logger.error(f"Google Workspace validation failed: {str(e)}")
        sys.exit(1)

def validate_cloudflare_access():
    """Verify Cloudflare API token has Access permissions"""
    try:
        headers = {
            "Authorization": f"Bearer {os.getenv('CLOUDFLARE_API_TOKEN')}",
            "Content-Type": "application/json"
        }
        # List Cloudflare accounts to check permissions
        resp = requests.get("https://api.cloudflare.com/client/v4/accounts", headers=headers)
        resp.raise_for_status()
        accounts = resp.json().get("result", [])
        if not accounts:
            logger.error("No Cloudflare accounts found for API token")
            sys.exit(1)
        logger.info(f"Cloudflare accounts accessible: {[a['name'] for a in accounts]}")
    except Exception as e:
        logger.error(f"Cloudflare validation failed: {str(e)}")
        sys.exit(1)

def validate_gcp_iap_permissions():
    """Check GCP project has IAP API enabled and permissions"""
    try:
        from google.cloud import iap_v1
        client = iap_v1.IdentityAwareProxyAdminServiceClient()
        project_path = f"projects/{os.getenv('GCP_PROJECT_ID')}"
        # List IAP policies to check access
        policies = client.get_iam_policy(resource=project_path)
        logger.info(f"GCP IAP IAM policy retrieved: {policies}")
        logger.info("GCP IAP permissions validated")
    except Exception as e:
        logger.error(f"GCP IAP validation failed: {str(e)}")
        sys.exit(1)

if __name__ == "__main__":
    logger.info("Starting prerequisite validation for zero-trust stack")
    validate_env_vars()
    validate_google_workspace_idp()
    validate_cloudflare_access()
    validate_gcp_iap_permissions()
    logger.info("All prerequisites validated successfully. Proceeding to deployment.")

# Step 2: Deploy Sample Workloads (GKE + Nginx)
# Terraform 1.7+ configuration for GCP and simulated on-prem workloads
terraform {
  required_version = ">= 1.7.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }
}

# Configure GCP provider
provider "google" {
  project = var.gcp_project_id
  region  = var.gcp_region
}

# Configure Cloudflare provider
provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

# Variable definitions
variable "gcp_project_id" {
  type        = string
  description = "GCP project ID for workload deployment"
}

variable "gcp_region" {
  type        = string
  default     = "us-central1"
  description = "GCP region for resource deployment"
}

variable "cloudflare_api_token" {
  type        = string
  sensitive   = true
  description = "Cloudflare API token with Account:Edit permissions"
}

variable "workspace_domain" {
  type        = string
  description = "Google Workspace domain for identity"
}

# Deploy VPC for GKE
resource "google_compute_network" "zero_trust_vpc" {
  name                    = "zero-trust-vpc"
  auto_create_subnetworks = false
  mtu                     = 1460
}

# Deploy subnet for GKE
resource "google_compute_subnetwork" "gke_subnet" {
  name          = "gke-subnet"
  ip_cidr_range = "10.0.0.0/24"
  region        = var.gcp_region
  network       = google_compute_network.zero_trust_vpc.id
  # Enable Private Google Access for GKE nodes
  private_ip_google_access = true
}

# Deploy GKE cluster (public endpoint for demo, disable for prod)
resource "google_container_cluster" "zero_trust_gke" {
  name     = "zero-trust-gke-cluster"
  location = var.gcp_region
  # Use a single node pool for demo, scale for prod
  initial_node_count = 1
  # Disable basic auth
  master_auth {
    client_certificate_config {
      issue_client_certificate = false
    }
  }
  # Enable IAP for GKE
  resource_labels = {
    "zero-trust" = "enabled"
  }
  network    = google_compute_network.zero_trust_vpc.id
  subnetwork = google_compute_subnetwork.gke_subnet.id
}

# Deploy sample Nginx app to GKE
resource "kubernetes_deployment" "nginx_app" {
  metadata {
    name = "sample-nginx-app"
    labels = {
      app = "nginx-app"
    }
  }
  spec {
    replicas = 2
    selector {
      match_labels = {
        app = "nginx-app"
      }
    }
    template {
      metadata {
        labels = {
          app = "nginx-app"
        }
      }
      spec {
        container {
          image = "nginx:1.25.3"
          name  = "nginx"
          port {
            container_port = 80
          }
          # Health check for IAP
          liveness_probe {
            http_get {
              path = "/"
              port = 80
            }
            initial_delay_seconds = 3
            period_seconds        = 3
          }
        }
      }
    }
  }
}

# Expose Nginx app via GKE Service (type LoadBalancer for demo)
resource "kubernetes_service" "nginx_service" {
  metadata {
    name = "nginx-service"
  }
  spec {
    selector = {
      app = "nginx-app"
    }
    port {
      port        = 80
      target_port = 80
    }
    type = "LoadBalancer"
  }
}

# Simulate on-prem Nginx instance (GCE with public IP)
resource "google_compute_instance" "on_prem_nginx" {
  name         = "on-prem-nginx-sim"
  machine_type = "e2-micro"
  zone         = "${var.gcp_region}-a"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }
  network_interface {
    network = "default" # Use default VPC to simulate on-prem
    access_config {} # Assign public IP
  }
  # Install Nginx via startup script
  metadata_startup_script = <<-SCRIPT
    #!/bin/bash
    apt-get update -y
    apt-get install nginx -y
    systemctl start nginx
    systemctl enable nginx
  SCRIPT
}

# Output workload endpoints
output "gke_nginx_endpoint" {
  value = kubernetes_service.nginx_service.load_balancer_ingress[0].ip
}

output "on_prem_nginx_public_ip" {
  value = google_compute_instance.on_prem_nginx.network_interface[0].access_config[0].nat_ip
}

# Step 3: Configure Cloudflare Access for Edge Authentication
# Terraform configuration for Cloudflare Access resources
resource "cloudflare_access_application" "gke_nginx_app" {
  account_id = var.cloudflare_account_id
  name       = "GKE Nginx Sample App"
  domain     = "gke-nginx.${var.cloudflare_zone}"
  type       = "self_hosted"
  # Enable CORS for IAP integration
  cors_headers {
    allowed_methods = ["GET", "POST", "PUT", "DELETE"]
    allowed_origins = ["https://${var.cloudflare_zone}"]
    allow_credentials = true
  }
}

resource "cloudflare_access_application" "on_prem_nginx_app" {
  account_id = var.cloudflare_account_id
  name       = "On-Prem Nginx Sim"
  domain     = "on-prem-nginx.${var.cloudflare_zone}"
  type       = "self_hosted"
}

# Configure Google Workspace as OIDC IdP for Cloudflare Access
resource "cloudflare_access_identity_provider" "google_workspace_idp" {
  account_id = var.cloudflare_account_id
  name       = "Google Workspace"
  type       = "google"
  config {
    client_id     = var.google_workspace_oidc_client_id
    client_secret = var.google_workspace_oidc_client_secret
    # Scopes to request from Google
    scopes = ["email", "profile", "openid"]
    # Workspace domain restriction
    allowed_domains = [var.workspace_domain]
  }
}

# Access policy for GKE app: allow only workspace users with engineering role
resource "cloudflare_access_policy" "gke_engineering_only" {
  application_id = cloudflare_access_application.gke_nginx_app.id
  account_id     = var.cloudflare_account_id
  name           = "Engineering Only GKE Access"
  decision       = "allow"
  # Include users with engineering group membership
  include {
    group = ["${var.workspace_domain}/engineering"]
  }
  # Require MFA for access
  require {
    mfa = true
  }
  # Session length: 8 hours
  session_duration = "8h"
}

# Access policy for on-prem app: allow all workspace users
resource "cloudflare_access_policy" "on_prem_all_users" {
  application_id = cloudflare_access_application.on_prem_nginx_app.id
  account_id     = var.cloudflare_account_id
  name           = "All Workspace Users On-Prem Access"
  decision       = "allow"
  include {
    email_domain = [var.workspace_domain]
  }
  session_duration = "4h"
}

# Configure Cloudflare Tunnel to route traffic to on-prem Nginx
resource "cloudflare_tunnel" "on_prem_tunnel" {
  account_id = var.cloudflare_account_id
  name       = "on-prem-nginx-tunnel"
  secret     = var.cloudflare_tunnel_secret
}

resource "cloudflare_tunnel_config" "on_prem_tunnel_config" {
  account_id = var.cloudflare_account_id
  tunnel_id = cloudflare_tunnel.on_prem_tunnel.id
  config {
    ingress {
      hostname = cloudflare_access_application.on_prem_nginx_app.domain
      service  = "http://${google_compute_instance.on_prem_nginx.network_interface[0].access_config[0].nat_ip}:80"
    }
    ingress {
      service = "http_status:404"
    }
  }
}

# Variables for Cloudflare config
variable "cloudflare_account_id" {
  type        = string
  description = "Cloudflare account ID"
}

variable "cloudflare_zone" {
  type        = string
  description = "Cloudflare zone (domain) for applications"
}

variable "google_workspace_oidc_client_id" {
  type        = string
  sensitive   = true
  description = "Google Workspace OIDC client ID"
}

variable "google_workspace_oidc_client_secret" {
  type        = string
  sensitive   = true
  description = "Google Workspace OIDC client secret"
}

variable "cloudflare_tunnel_secret" {
  type        = string
  sensitive   = true
  description = "Cloudflare Tunnel secret (base64 encoded)"
}

# Output Cloudflare Access endpoints
output "cloudflare_gke_access_endpoint" {
  value = "https://${cloudflare_access_application.gke_nginx_app.domain}"
}

output "cloudflare_on_prem_access_endpoint" {
  value = "https://${cloudflare_access_application.on_prem_nginx_app.domain}"
}

# Step 4: Configure Google Cloud IAP for GCP Workload Authorization
# Enable IAP API for GCP project
resource "google_project_service" "iap_api" {
  project = var.gcp_project_id
  service = "iap.googleapis.com"
  # Disable API on destroy for cleanup
  disable_on_destroy = false
}

# Configure OAuth consent screen for IAP
resource "google_iap_app_engine_version_iam_member" "oauth_consent" {
  project = var.gcp_project_id
  # Use internal consent screen for Workspace users
  consent_screen_config {
    name             = "Zero Trust IAP Consent"
    support_email    = "admin@${var.workspace_domain}"
    # Restrict to Workspace domain
    authorized_domains = [var.workspace_domain]
  }
}

# IAP policy for GKE Nginx service
# Allow only users with access via Cloudflare Access (validate JWT from Cloudflare)
resource "google_iap_web_type_app_engine_iam_member" "gke_iap_policy" {
  project = var.gcp_project_id
  # IAP resource path for GKE service
  web_type = "app_engine"
  # Only allow requests with valid Cloudflare Access JWT
  role = "roles/iap.httpsResourceAccessor"
  member = "domain:${var.workspace_domain}"
  # Condition to check Cloudflare JWT issuer
  condition {
    title       = "Cloudflare JWT Check"
    description = "Only allow requests with valid Cloudflare Access JWT"
    expression  = "request.auth.claims.iss == 'https://access.cloudflare.com'"
  }
}

# Configure IAP to trust Cloudflare Access as external identity provider
resource "google_iap_settings" "gke_iap_settings" {
  project = var.gcp_project_id
  service = "projects/${var.gcp_project_id}/iap_web/compute/services/${kubernetes_service.nginx_service.id}"
  # Enable IAP for the GKE service
  iap_settings {
    enable_iap = true
    # External IdP configuration for Cloudflare
    external_idp_config {
      idp_id = "cloudflare-access"
      # Cloudflare Access OIDC issuer URL
      issuer_uri = "https://access.cloudflare.com"
      # Audience is Cloudflare Access application client ID
      audience = cloudflare_access_application.gke_nginx_app.client_id
    }
  }
}

# Configure IAP TCP forwarding for on-prem Nginx (simulated via GCE)
resource "google_iap_tunnel_iam_member" "on_prem_iap_tunnel" {
  project = var.gcp_project_id
  zone    = "${var.gcp_region}-a"
  instance = google_compute_instance.on_prem_nginx.name
  role    = "roles/iap.tunnelResourceAccessor"
  member  = "domain:${var.workspace_domain}"
}

# Output IAP protected endpoints
output "gke_iap_protected_url" {
  value = "https://${kubernetes_service.nginx_service.load_balancer_ingress[0].ip}"
}

output "on_prem_iap_tunnel_command" {
  value = "gcloud compute ssh --tunnel-through-iap ${google_compute_instance.on_prem_nginx.name} --zone ${var.gcp_region}-a"
}

# Step 5: Integrate Cloudflare Access & GCP IAP - Validation Script
import os
import sys
import json
import logging
import requests
from jose import JWTError, jwt
from google.auth.transport.requests import Request
from google.oauth2 import service_account

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.StreamHandler(sys.stdout)]
)
logger = logging.getLogger(__name__)

# Cloudflare Access JWT configuration
CLOUDFLARE_ISSUER = "https://access.cloudflare.com"
CLOUDFLARE_AUDIENCE = os.getenv("CLOUDFLARE_ACCESS_APPLICATION_CLIENT_ID")

# GCP IAP JWT configuration
GCP_IAP_ISSUER = "https://cloud.google.com/iap"
GCP_IAP_AUDIENCE = os.getenv("GCP_IAP_WEB_APP_CLIENT_ID")

# Public keys for JWT validation (cached)
_cloudflare_keys = None
_gcp_iap_keys = None

def get_cloudflare_public_keys():
    """Fetch Cloudflare Access public keys for JWT validation"""
    global _cloudflare_keys
    if _cloudflare_keys:
        return _cloudflare_keys
    try:
        resp = requests.get(f"{CLOUDFLARE_ISSUER}/cdn-cgi/access/certs")
        resp.raise_for_status()
        _cloudflare_keys = resp.json()
        logger.info("Fetched Cloudflare Access public keys")
        return _cloudflare_keys
    except Exception as e:
        logger.error(f"Failed to fetch Cloudflare public keys: {str(e)}")
        sys.exit(1)

def get_gcp_iap_public_keys():
    """Fetch GCP IAP public keys for JWT validation"""
    global _gcp_iap_keys
    if _gcp_iap_keys:
        return _gcp_iap_keys
    try:
        resp = requests.get("https://www.googleapis.com/oauth2/v3/certs")
        resp.raise_for_status()
        _gcp_iap_keys = resp.json()
        logger.info("Fetched GCP IAP public keys")
        return _gcp_iap_keys
    except Exception as e:
        logger.error(f"Failed to fetch GCP IAP public keys: {str(e)}")
        sys.exit(1)

def validate_cloudflare_jwt(token):
    """Validate Cloudflare Access JWT"""
    try:
        keys = get_cloudflare_public_keys()
        # Decode JWT with Cloudflare public key
        payload = jwt.decode(
            token,
            keys,
            algorithms=["RS256"],
            issuer=CLOUDFLARE_ISSUER,
            audience=CLOUDFLARE_AUDIENCE
        )
        logger.info(f"Cloudflare JWT validated. User: {payload.get('email')}")
        return payload
    except JWTError as e:
        logger.error(f"Cloudflare JWT validation failed: {str(e)}")
        return None

def validate_gcp_iap_jwt(token):
    """Validate GCP IAP JWT"""
    try:
        keys = get_gcp_iap_public_keys()
        # Decode JWT with GCP public key
        payload = jwt.decode(
            token,
            keys,
            algorithms=["RS256"],
            issuer=GCP_IAP_ISSUER,
            audience=GCP_IAP_AUDIENCE
        )
        logger.info(f"GCP IAP JWT validated. User: {payload.get('email')}")
        return payload
    except JWTError as e:
        logger.error(f"GCP IAP JWT validation failed: {str(e)}")
        return None

def test_end_to_end_access(cloudflare_endpoint, iap_endpoint):
    """Test end-to-end zero-trust access flow"""
    # Step 1: Authenticate via Cloudflare Access to get JWT
    logger.info(f"Testing Cloudflare Access endpoint: {cloudflare_endpoint}")
    try:
        # Simulate browser redirect to Cloudflare Access login
        resp = requests.get(cloudflare_endpoint, allow_redirects=False)
        if resp.status_code != 302:
            logger.error(f"Cloudflare Access did not redirect to login: {resp.status_code}")
            return False
        # In production, this would be a full OIDC flow; for demo, use test token
        test_cf_token = os.getenv("TEST_CLOUDFLARE_JWT")
        if not test_cf_token:
            logger.warning("No test Cloudflare JWT provided, skipping JWT validation")
        else:
            cf_payload = validate_cloudflare_jwt(test_cf_token)
            if not cf_payload:
                return False
    except Exception as e:
        logger.error(f"Cloudflare Access test failed: {str(e)}")
        return False

    # Step 2: Access IAP protected endpoint with Cloudflare JWT
    logger.info(f"Testing GCP IAP endpoint: {iap_endpoint}")
    try:
        headers = {"X-Cloudflare-Access-JWT": test_cf_token} if test_cf_token else {}
        resp = requests.get(iap_endpoint, headers=headers)
        if resp.status_code == 200:
            logger.info("End-to-end access test passed!")
            return True
        else:
            logger.error(f"IAP endpoint returned {resp.status_code}: {resp.text}")
            return False
    except Exception as e:
        logger.error(f"IAP access test failed: {str(e)}")
        return False

if __name__ == "__main__":
    logger.info("Starting Cloudflare + GCP IAP integration validation")
    # Validate environment variables
    required_envs = ["CLOUDFLARE_ACCESS_APPLICATION_CLIENT_ID", "GCP_IAP_WEB_APP_CLIENT_ID"]
    missing = [var for var in required_envs if not os.getenv(var)]
    if missing:
        logger.error(f"Missing env vars: {missing}")
        sys.exit(1)
    # Run end-to-end test
    test_result = test_end_to_end_access(
        os.getenv("CLOUDFLARE_GKE_ENDPOINT"),
        os.getenv("GCP_IAP_GKE_ENDPOINT")
    )
    if test_result:
        logger.info("Integration validation successful. Zero-trust stack is operational.")
    else:
        logger.error("Integration validation failed. Check configuration.")
        sys.exit(1)

# Step 6: Audit & Monitor Zero-Trust Access
# Terraform configuration for log export to BigQuery

# Create BigQuery dataset for access logs
resource "google_bigquery_dataset" "zero_trust_logs" {
  dataset_id    = "zero_trust_access_logs"
  project       = var.gcp_project_id
  friendly_name = "Zero Trust Access Logs"
  description   = "Stores Cloudflare Access and GCP IAP audit logs"
  location      = "US"
  # Retain logs for 365 days for compliance
  default_table_expiration_ms = 31536000000
}

# Export GCP IAP logs to BigQuery
resource "google_logging_project_sink" "iap_logs_sink" {
  name        = "iap-logs-to-bigquery"
  project     = var.gcp_project_id
  destination = "bigquery.googleapis.com/projects/${var.gcp_project_id}/datasets/${google_bigquery_dataset.zero_trust_logs.dataset_id}"
  # Filter for IAP access logs
  filter      = "resource.type=\"iap.googleapis.com/Web\" OR resource.type=\"iap.googleapis.com/Tunnel\""
  # Grant BigQuery write permissions to logging service account
  unique_writer_identity = true
}

# Export Cloudflare Access logs to BigQuery via Cloud Storage (intermediate)
resource "google_storage_bucket" "cloudflare_logs_bucket" {
  name          = "${var.gcp_project_id}-cloudflare-logs"
  location      = "US"
  force_destroy = true
  # Retain logs for 90 days
  lifecycle_rule {
    condition {
      age = 90
    }
    action {
      type = "Delete"
    }
  }
}

# Cloudflare Logpush job to export Access logs to GCS
resource "cloudflare_logpush_job" "access_logs" {
  account_id   = var.cloudflare_account_id
  name         = "Cloudflare Access Logs to GCS"
  destination_conf = "gs://${google_storage_bucket.cloudflare_logs_bucket.name}/access-logs/{date}"
  logpull_options = "fields=RayID,ClientIP,EdgeStartTimestamp,EdgeEndTimestamp,RequestURL,UserEmail,Decision,Country"
  dataset       = "access_requests"
  enabled       = true
}

# BigQuery transfer job to load Cloudflare logs from GCS
resource "google_bigquery_data_transfer_config" "cloudflare_logs_transfer" {
  display_name           = "Cloudflare Access Logs Transfer"
  project                = var.gcp_project_id
  region                 = "US"
  data_source_id         = "google_cloud_storage"
  schedule               = "every 1 hours"
  destination_dataset_id = google_bigquery_dataset.zero_trust_logs.dataset_id
  params = {
    data_path_template = "gs://${google_storage_bucket.cloudflare_logs_bucket.name}/access-logs/*"
    destination_table_name_template = "cloudflare_access_logs_{run_date}"
    file_format = "JSON"
  }
}

# SQL query to analyze access patterns (sample)
# Run this in BigQuery console to get top users by access attempts
/*
SELECT
  UserEmail,
  COUNT(*) AS access_attempts,
  SUM(CASE WHEN Decision = 'allow' THEN 1 ELSE 0 END) AS allowed_attempts,
  SUM(CASE WHEN Decision = 'deny' THEN 1 ELSE 0 END) AS denied_attempts
FROM
  `zero_trust_access_logs.cloudflare_access_logs_*`
WHERE
  _TABLE_SUFFIX >= FORMAT_DATE("%Y%m%d", DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))
GROUP BY
  UserEmail
ORDER BY
  access_attempts DESC
LIMIT 10;
*/

# Output BigQuery dataset ID
output "bigquery_dataset_id" {
  value = google_bigquery_dataset.zero_trust_logs.dataset_id
}

# Step 7: Automate Deployment with Terraform (GitHub Actions Workflow)
name: Deploy Zero-Trust Stack

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

env:
  TF_VERSION: "1.7.3"
  GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

jobs:
  terraform-plan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}

      - name: Terraform Init
        run: terraform init
        working-directory: ./terraform

      - name: Terraform Validate
        run: terraform validate
        working-directory: ./terraform

      - name: Terraform Plan
        run: terraform plan -out=tfplan
        working-directory: ./terraform
        env:
          TF_VAR_gcp_project_id: ${{ env.GCP_PROJECT_ID }}
          TF_VAR_cloudflare_api_token: ${{ env.CLOUDFLARE_API_TOKEN }}
          TF_VAR_cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          TF_VAR_workspace_domain: ${{ secrets.WORKSPACE_DOMAIN }}

      - name: Upload Terraform Plan
        uses: actions/upload-artifact@v4
        with:
          name: tfplan
          path: ./terraform/tfplan

  terraform-apply:
    runs-on: ubuntu-latest
    needs: terraform-plan
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}

      - name: Download Terraform Plan
        uses: actions/download-artifact@v4
        with:
          name: tfplan
          path: ./terraform

      - name: Terraform Apply
        run: terraform apply -auto-approve tfplan
        working-directory: ./terraform
        env:
          TF_VAR_gcp_project_id: ${{ env.GCP_PROJECT_ID }}
          TF_VAR_cloudflare_api_token: ${{ env.CLOUDFLARE_API_TOKEN }}
          TF_VAR_cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          TF_VAR_workspace_domain: ${{ secrets.WORKSPACE_DOMAIN }}

      - name: Run Integration Tests
        run: python scripts/integration_test.py
        env:
          CLOUDFLARE_ACCESS_APPLICATION_CLIENT_ID: ${{ secrets.CLOUDFLARE_ACCESS_CLIENT_ID }}
          GCP_IAP_WEB_APP_CLIENT_ID: ${{ secrets.GCP_IAP_CLIENT_ID }}
          CLOUDFLARE_GKE_ENDPOINT: ${{ secrets.CLOUDFLARE_GKE_ENDPOINT }}
          GCP_IAP_GKE_ENDPOINT: ${{ secrets.GCP_IAP_GKE_ENDPOINT }}

      - name: Notify Slack on Success
        if: success()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          slack-message: "Zero-trust stack deployed successfully! 🎉"
          channels: ${{ secrets.SLACK_CHANNEL_ID }}
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

      - name: Notify Slack on Failure
        if: failure()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          slack-message: "Zero-trust stack deployment failed! ❌ Check GitHub Actions for details."
          channels: ${{ secrets.SLACK_CHANNEL_ID }}
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

# Generate a 24-hour valid mTLS certificate for SSH access to on-prem Nginx
cloudflared access login --app-id ${CLOUDFLARE_ACCESS_APP_ID}
cloudflared access certificate --app-id ${CLOUDFLARE_ACCESS_APP_ID} \
  --cn "ssh-user" \
  --validity 24h \
  --output ssh-cert.pem
# Use the certificate for SSH via cloudflared proxy
cloudflared access ssh --hostname ssh.on-prem-nginx.example.com --cert ssh-cert.pem

# CEL condition for GCP IAP to allow only corporate IPs and MFA-enabled users
condition {
  title       = "Corporate IP + MFA Requirement"
  description = "Only allow access from corporate IPs with MFA"
  expression  = <<-CEL
    request.auth.claims.iss == 'https://access.cloudflare.com' &&
    request.auth.claims.mfa == 'true' &&
    origin.ip in [
      '203.0.113.0/24', # Corporate HQ
      '198.51.100.0/24' # Corporate Satellite Office
    ]
  CEL
}

-- BigQuery query to find denied access attempts across Cloudflare and GCP IAP
SELECT
  'Cloudflare' AS source,
  UserEmail AS user,
  RequestURL AS resource,
  Decision AS outcome,
  EdgeStartTimestamp AS timestamp
FROM
  `zero_trust_access_logs.cloudflare_access_logs_*`
WHERE
  Decision = 'deny' AND
  _TABLE_SUFFIX >= FORMAT_DATE("%Y%m%d", DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))
UNION ALL
SELECT
  'GCP IAP' AS source,
  JSON_EXTRACT_SCALAR(proto_payload, '$.authenticationInfo.principalEmail') AS user,
  JSON_EXTRACT_SCALAR(proto_payload, '$.resourceName') AS resource,
  JSON_EXTRACT_SCALAR(proto_payload, '$.status.message') AS outcome,
  timestamp AS timestamp
FROM
  `zero_trust_access_logs.gcp_iap_logs_*`
WHERE
  JSON_EXTRACT_SCALAR(proto_payload, '$.status.message') != 'OK' AND
  _TABLE_SUFFIX >= FORMAT_DATE("%Y%m%d", DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))
ORDER BY
  timestamp DESC
LIMIT 50;

cloudflare-gcp-iap-guide/
├── terraform/
│   ├── main.tf                # Core infrastructure config
│   ├── variables.tf           # Input variables
│   ├── outputs.tf             # Output endpoints
│   ├── cloudflare.tf          # Cloudflare Access resources
│   ├── gcp.tf                 # GCP IAP and workload resources
│   ├── logs.tf                # Log export to BigQuery
│   └── versions.tf            # Provider version constraints
├── scripts/
│   ├── validate_prereqs.py    # Step 1 prerequisite validation
│   ├── integration_test.py    # Step 5 integration validation
│   └── log_queries.sql        # Sample BigQuery log queries
├── .github/
│   └── workflows/
│       └── deploy.yml         # Step 7 GitHub Actions workflow
├── README.md                  # Project overview and setup steps
└── LICENSE                    # MIT License