groups

Creates, updates, deletes, gets or lists a groups resource.

Overview

Name	groups
Type	Resource
Id	cloudflare.zero_trust.groups

Fields

The following fields are returned by SELECT queries:

get_by_account

Get an Access group response

Name	Datatype	Description
id	string	UUID. (example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415)
name	string	The name of the Access group. (example: Allow devs)
created_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
exclude	array	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
is_default	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
require	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
updated_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)

get_by_zone

Get an Access group response

Name	Datatype	Description
id	string	UUID. (example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415)
name	string	The name of the Access group. (example: Allow devs)
created_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
exclude	array	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
is_default	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
require	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
updated_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_by_account	select	group_id, account_id		Fetches a single Access group.
get_by_zone	select	group_id, zone_id		Fetches a single Access group.
create_by_account	insert	account_id, name, include		Creates a new Access group.
create_by_zone	insert	zone_id, name, include		Creates a new Access group.
update_by_account	replace	group_id, account_id, name, include		Updates a configured Access group.
update_by_zone	replace	group_id, zone_id, name, include		Updates a configured Access group.
delete_by_account	delete	group_id, account_id		Deletes an Access group.
delete_by_zone	delete	group_id, zone_id		Deletes an Access group.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_id	string	The Cloudflare account ID.
group_id	string	The Access group ID.
zone_id	string	The Cloudflare zone ID.

SELECT examples

get_by_account

Fetches a single Access group.

SELECT
id,
name,
created_at,
exclude,
include,
is_default,
require,
updated_at
FROM cloudflare.zero_trust.groups
WHERE group_id = '{{ group_id }}' -- required
AND account_id = '{{ account_id }}' -- required
;

get_by_zone

Fetches a single Access group.

SELECT
id,
name,
created_at,
exclude,
include,
is_default,
require,
updated_at
FROM cloudflare.zero_trust.groups
WHERE group_id = '{{ group_id }}' -- required
AND zone_id = '{{ zone_id }}' -- required
;

INSERT examples

create_by_account

Creates a new Access group.

INSERT INTO cloudflare.zero_trust.groups (
exclude,
include,
is_default,
name,
require,
account_id
)
SELECT 
'{{ exclude }}',
'{{ include }}' /* required */,
{{ is_default }},
'{{ name }}' /* required */,
'{{ require }}',
'{{ account_id }}'
RETURNING
errors,
messages,
result,
success
;

create_by_zone

Creates a new Access group.

INSERT INTO cloudflare.zero_trust.groups (
exclude,
include,
is_default,
name,
require,
zone_id
)
SELECT 
'{{ exclude }}',
'{{ include }}' /* required */,
{{ is_default }},
'{{ name }}' /* required */,
'{{ require }}',
'{{ zone_id }}'
RETURNING
errors,
messages,
result,
success
;

Manifest

# Description fields are for documentation purposes
- name: groups
props:
  - name: account_id
    value: "{{ account_id }}"
    description: Required parameter for the groups resource.
  - name: zone_id
    value: "{{ zone_id }}"
    description: Required parameter for the groups resource.
  - name: exclude
    description: |
      Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
    value:
      - group:
          id: "{{ id }}"
        any_valid_service_token: "{{ any_valid_service_token }}"
        auth_context:
          ac_id: "{{ ac_id }}"
          id: "{{ id }}"
          identity_provider_id: "{{ identity_provider_id }}"
        auth_method:
          auth_method: "{{ auth_method }}"
        azureAD:
          id: "{{ id }}"
          identity_provider_id: "{{ identity_provider_id }}"
        certificate: "{{ certificate }}"
        common_name:
          common_name: "{{ common_name }}"
        geo:
          country_code: "{{ country_code }}"
        device_posture:
          integration_uid: "{{ integration_uid }}"
        email_domain:
          domain: "{{ domain }}"
        email_list:
          id: "{{ id }}"
        email:
          email: "{{ email }}"
        everyone: "{{ everyone }}"
        external_evaluation:
          evaluate_url: "{{ evaluate_url }}"
          keys_url: "{{ keys_url }}"
        github-organization:
          identity_provider_id: "{{ identity_provider_id }}"
          name: "{{ name }}"
          team: "{{ team }}"
        gsuite:
          email: "{{ email }}"
          identity_provider_id: "{{ identity_provider_id }}"
        login_method:
          id: "{{ id }}"
        ip_list:
          id: "{{ id }}"
        ip:
          ip: "{{ ip }}"
        okta:
          identity_provider_id: "{{ identity_provider_id }}"
          name: "{{ name }}"
        saml:
          attribute_name: "{{ attribute_name }}"
          attribute_value: "{{ attribute_value }}"
          identity_provider_id: "{{ identity_provider_id }}"
        oidc:
          claim_name: "{{ claim_name }}"
          claim_value: "{{ claim_value }}"
          identity_provider_id: "{{ identity_provider_id }}"
        service_token:
          token_id: "{{ token_id }}"
        linked_app_token:
          app_uid: "{{ app_uid }}"
        user_risk_score:
          user_risk_score:
            - "{{ user_risk_score }}"
  - name: include
    description: |
      Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
    value:
      - group:
          id: "{{ id }}"
        any_valid_service_token: "{{ any_valid_service_token }}"
        auth_context:
          ac_id: "{{ ac_id }}"
          id: "{{ id }}"
          identity_provider_id: "{{ identity_provider_id }}"
        auth_method:
          auth_method: "{{ auth_method }}"
        azureAD:
          id: "{{ id }}"
          identity_provider_id: "{{ identity_provider_id }}"
        certificate: "{{ certificate }}"
        common_name:
          common_name: "{{ common_name }}"
        geo:
          country_code: "{{ country_code }}"
        device_posture:
          integration_uid: "{{ integration_uid }}"
        email_domain:
          domain: "{{ domain }}"
        email_list:
          id: "{{ id }}"
        email:
          email: "{{ email }}"
        everyone: "{{ everyone }}"
        external_evaluation:
          evaluate_url: "{{ evaluate_url }}"
          keys_url: "{{ keys_url }}"
        github-organization:
          identity_provider_id: "{{ identity_provider_id }}"
          name: "{{ name }}"
          team: "{{ team }}"
        gsuite:
          email: "{{ email }}"
          identity_provider_id: "{{ identity_provider_id }}"
        login_method:
          id: "{{ id }}"
        ip_list:
          id: "{{ id }}"
        ip:
          ip: "{{ ip }}"
        okta:
          identity_provider_id: "{{ identity_provider_id }}"
          name: "{{ name }}"
        saml:
          attribute_name: "{{ attribute_name }}"
          attribute_value: "{{ attribute_value }}"
          identity_provider_id: "{{ identity_provider_id }}"
        oidc:
          claim_name: "{{ claim_name }}"
          claim_value: "{{ claim_value }}"
          identity_provider_id: "{{ identity_provider_id }}"
        service_token:
          token_id: "{{ token_id }}"
        linked_app_token:
          app_uid: "{{ app_uid }}"
        user_risk_score:
          user_risk_score:
            - "{{ user_risk_score }}"
  - name: is_default
    value: {{ is_default }}
    description: |
      Whether this is the default group
  - name: name
    value: "{{ name }}"
    description: |
      The name of the Access group.
  - name: require
    description: |
      Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
    value:
      - group:
          id: "{{ id }}"
        any_valid_service_token: "{{ any_valid_service_token }}"
        auth_context:
          ac_id: "{{ ac_id }}"
          id: "{{ id }}"
          identity_provider_id: "{{ identity_provider_id }}"
        auth_method:
          auth_method: "{{ auth_method }}"
        azureAD:
          id: "{{ id }}"
          identity_provider_id: "{{ identity_provider_id }}"
        certificate: "{{ certificate }}"
        common_name:
          common_name: "{{ common_name }}"
        geo:
          country_code: "{{ country_code }}"
        device_posture:
          integration_uid: "{{ integration_uid }}"
        email_domain:
          domain: "{{ domain }}"
        email_list:
          id: "{{ id }}"
        email:
          email: "{{ email }}"
        everyone: "{{ everyone }}"
        external_evaluation:
          evaluate_url: "{{ evaluate_url }}"
          keys_url: "{{ keys_url }}"
        github-organization:
          identity_provider_id: "{{ identity_provider_id }}"
          name: "{{ name }}"
          team: "{{ team }}"
        gsuite:
          email: "{{ email }}"
          identity_provider_id: "{{ identity_provider_id }}"
        login_method:
          id: "{{ id }}"
        ip_list:
          id: "{{ id }}"
        ip:
          ip: "{{ ip }}"
        okta:
          identity_provider_id: "{{ identity_provider_id }}"
          name: "{{ name }}"
        saml:
          attribute_name: "{{ attribute_name }}"
          attribute_value: "{{ attribute_value }}"
          identity_provider_id: "{{ identity_provider_id }}"
        oidc:
          claim_name: "{{ claim_name }}"
          claim_value: "{{ claim_value }}"
          identity_provider_id: "{{ identity_provider_id }}"
        service_token:
          token_id: "{{ token_id }}"
        linked_app_token:
          app_uid: "{{ app_uid }}"
        user_risk_score:
          user_risk_score:
            - "{{ user_risk_score }}"

REPLACE examples

update_by_account

Updates a configured Access group.

REPLACE cloudflare.zero_trust.groups
SET 
exclude = '{{ exclude }}',
include = '{{ include }}',
is_default = {{ is_default }},
name = '{{ name }}',
require = '{{ require }}'
WHERE 
group_id = '{{ group_id }}' --required
AND account_id = '{{ account_id }}' --required
AND name = '{{ name }}' --required
AND include = '{{ include }}' --required
RETURNING
errors,
messages,
result,
success;

update_by_zone

Updates a configured Access group.

REPLACE cloudflare.zero_trust.groups
SET 
exclude = '{{ exclude }}',
include = '{{ include }}',
is_default = {{ is_default }},
name = '{{ name }}',
require = '{{ require }}'
WHERE 
group_id = '{{ group_id }}' --required
AND zone_id = '{{ zone_id }}' --required
AND name = '{{ name }}' --required
AND include = '{{ include }}' --required
RETURNING
errors,
messages,
result,
success;

DELETE examples

delete_by_account

Deletes an Access group.

DELETE FROM cloudflare.zero_trust.groups
WHERE group_id = '{{ group_id }}' --required
AND account_id = '{{ account_id }}' --required
;

delete_by_zone

Deletes an Access group.

DELETE FROM cloudflare.zero_trust.groups
WHERE group_id = '{{ group_id }}' --required
AND zone_id = '{{ zone_id }}' --required
;