Zero Trust Architecture

package zerotrust.access

import rego.v1

default allow := false

# Require ALL conditions for access (never trust, always verify)
allow if {
    identity_verified
    device_compliant
    context_acceptable
    permission_granted
}

# Identity must be authenticated with MFA
identity_verified if {
    input.identity.authenticated == true
    input.identity.mfa_verified == true
    time.now_ns() < input.identity.token_expiry_ns
}

# Device must meet compliance baseline
device_compliant if {
    input.device.managed == true
    input.device.os_patched == true
    input.device.encryption_enabled == true
    input.device.edr_running == true
    input.device.risk_score < 50
}

# Context checks: location, time, behavior
context_acceptable if {
    not input.context.impossible_travel
    input.context.risk_score < 70
}

# RBAC + resource-level check
permission_granted if {
    required_role := data.resource_roles[input.resource.path][input.method]
    required_role == input.identity.roles[_]
}

{
  "displayName": "Require MFA + Compliant Device for Sensitive Apps",
  "state": "enabled",
  "conditions": {
    "applications": {
      "includeApplications": ["finance-portal", "hr-admin"]
    },
    "users": {
      "includeGroups": ["all-employees"]
    },
    "signInRiskLevels": ["medium", "high"],
    "platforms": {
      "includePlatforms": ["all"]
    }
  },
  "grantControls": {
    "operator": "AND",
    "builtInControls": ["mfa", "compliantDevice"]
  },
  "sessionControls": {
    "signInFrequency": { "value": 4, "type": "hours" },
    "persistentBrowser": { "isEnabled": true, "mode": "never" }
  }
}

# Zero Trust micro-segmentation: default deny ALL traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
# Allow only API gateway -> backend on port 8080
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-service
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-gateway
    ports:
    - port: 8080
      protocol: TCP
  egress:
  - to:    # Allow backend -> postgres only
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - port: 5432
      protocol: TCP
  - to:    # Allow DNS resolution
    ports:
    - port: 53
      protocol: UDP

# Cloudflare Access — ZTNA for internal apps (no VPN needed)
resource "cloudflare_access_application" "internal_wiki" {
  zone_id          = var.zone_id
  name             = "Internal Wiki"
  domain           = "wiki.internal.example.com"
  session_duration = "4h"
  type             = "self_hosted"
}

resource "cloudflare_access_policy" "wiki_access" {
  application_id = cloudflare_access_application.internal_wiki.id
  zone_id        = var.zone_id
  name           = "Require SSO + device posture"
  precedence     = 1
  decision       = "allow"

  include {
    group = [cloudflare_access_group.employees.id]
  }

  require {
    login_method   = [cloudflare_access_identity_provider.okta.id]
    device_posture = [
      cloudflare_device_posture_rule.disk_encryption.id,
      cloudflare_device_posture_rule.os_version.id,
    ]
  }
}

resource "cloudflare_device_posture_rule" "disk_encryption" {
  account_id = var.account_id
  name       = "Disk Encryption Required"
  type       = "disk_encryption"
  match { platform = "mac" }
  input { require_all = true }
}