Zero Trust Architecture Guide -- BeyondCorp, Microsegmentation & Continuous Verification

# Cloudflare Access identity-aware proxy policy
resource "cloudflare_access_application" "internal_apps" {
  zone_id          = var.cloudflare_zone_id
  name             = "Internal Applications"
  domain           = "internal.dodatech.com"
  session_duration = "24h"
  allowed_idps     = ["dodatech-okta"]

  policies {
    name = "Engineering Access"
    decision = "allow"

    include {
      email_domain = ["dodatech.com"]
    }

    require {
      okta_groups = ["engineering", "security", "sre"]
    }

    require {
      device_posture = ["device-posture-rule"]
    }
  }
}

# Device posture rule -- require macOS 14+ with disk encryption
resource "cloudflare_device_posture_rule" "macos_secure" {
  name   = "macOS Secure"
  type   = "os_version"
  match  = "greater_or_equal"
  value  = "14.0"
  os     = "mac"
  description = "Requires macOS 14+"
}
# Additional rule for disk encryption
resource "cloudflare_device_posture_rule" "disk_encryption" {
  name   = "Disk Encryption Enabled"
  type   = "disk_encrypted"
  os     = "mac"
  description = "Requires full disk encryption"
}

# Calico network policy for Zero Trust microsegmentation
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: app-tier-isolation
  namespace: production
spec:
  selector: app == "payment-service"
  ingress:
    - action: Allow
      protocol: TCP
      source:
        selector: app == "api-gateway"
      destination:
        ports:
          - 8080
    - action: Allow
      protocol: TCP
      source:
        selector: app == "health-checker"
      destination:
        ports:
          - 8080
  egress:
    - action: Allow
      protocol: TCP
      destination:
        selector: app == "database"
        ports:
          - 5432
    - action: Allow
      protocol: TCP
      destination:
        selector: app == "cache"
        ports:
          - 6379
    - action: Allow
      protocol: UDP
      destination:
        selector: app == "dns"
        ports:
          - 53
---
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: default-deny-all
spec:
  selector: all()
  ingress:
    - action: Deny
  egress:
    - action: Deny
  types:
    - Ingress
    - Egress

"""Real-time access policy evaluation for Zero Trust."""
import json
import hashlib
from datetime import datetime

class PolicyEvaluator:
    def __init__(self):
        self.policy_cache = {}
        self.max_users_per_ip = 3
        self.max_sessions_per_user = 5

    def evaluate_request(self, request):
        """Evaluate a single access request against zero trust policies."""

        score = 0
        reasons = []

        # Identity verification
        if not request.get("jwt"):
            return {"decision": "DENY", "reason": "No authentication token"}

        # Device posture check
        device = request.get("device", {})
        if device.get("os_version", "0") < "14.0":
            score -= 20
            reasons.append("Outdated OS version")

        if not device.get("disk_encrypted", False):
            score -= 30
            reasons.append("Disk encryption not enabled")

        if not device.get("firewall_enabled", False):
            score -= 10
            reasons.append("Firewall not active")

        # Behavioral anomalies
        user_profile = self._get_user_profile(request.get("user_id"))
        current_ip = request.get("source_ip")

        if user_profile.get("typical_ips") and current_ip not in user_profile["typical_ips"]:
            score -= 15
            reasons.append(f"Unusual source IP: {current_ip}")

        if user_profile.get("typical_geo") and \
           request.get("geo") not in user_profile["typical_geo"]:
            score -= 20
            reasons.append(f"Unusual geo: {request.get('geo')}")

        # Resource sensitivity
        resource_sensitivity = request.get("resource_sensitivity", "low")
        if resource_sensitivity == "high" and score < 50:
            return {"decision": "DENY", "reason": "Risk score too low for high-sensitivity resource",
                    "score": score, "details": reasons}

        if resource_sensitivity == "critical" and score < 80:
            return {"decision": "DENY", "reason": "Insufficient trust for critical resource",
                    "score": score, "details": reasons}

        if score >= 50:
            return {"decision": "ALLOW", "score": score, "details": reasons}
        else:
            return {"decision": "DENY", "score": score, "reason": "Risk score below threshold",
                    "details": reasons}

    def _get_user_profile(self, user_id):
        profiles = {
            "user-123": {
                "typical_ips": ["203.0.113.0/24"],
                "typical_geo": ["US-NY"]
            }
        }
        return profiles.get(user_id, {})

# Usage
request = {
    "user_id": "user-123",
    "jwt": "valid-token",
    "source_ip": "198.51.100.5",
    "geo": "US-CA",
    "resource_sensitivity": "high",
    "device": {
        "os_version": "14.5",
        "disk_encrypted": True,
        "firewall_enabled": True
    }
}

evaluator = PolicyEvaluator()
result = evaluator.evaluate_request(request)
print(json.dumps(result, indent=2))
# Expected output:
# {
#   "decision": "DENY",
#   "score": 65,
#   "reason": "Unusual geo: US-CA",
#   "details": ["Unusual source IP: 198.51.100.5", "Unusual geo: US-CA"]
# }

# Tailscale-like mesh VPN node configuration
[Interface]
PrivateKey = <node-private-key>
Address = 100.100.0.1/32
DNS = 100.100.0.1

# ACL: only allow SSH and HTTPS to specific nodes
[Peer]
# Application server
PublicKey = <app-server-public-key>
AllowedIPs = 100.100.0.10/32
# Only SSH and HTTPS ports allowed at the firewall level

[Peer]
# Database server
PublicKey = <db-server-public-key>
AllowedIPs = 100.100.0.20/32
# Only PostgreSQL port allowed

[Peer]
# Monitoring server  
PublicKey = <monitoring-public-key>
AllowedIPs = 0.0.0.0/0  # Full access for monitoring only

# Enable Identity-Aware Proxy on GCP
gcloud services enable iap.googleapis.com

# Create OAuth consent screen
gcloud alpha iap oauth-clients create \
  projects/$PROJECT_ID/brands/$BRAND_ID \
  --display-name="DodaTech IAP Client"

# Configure IAP on App Engine
gcloud iap web enable \
  --resource-type=app-engine \
  --service=default \
  --oauth2-client-id=$CLIENT_ID \
  --oauth2-client-secret=$CLIENT_SECRET

# Set access policy to allow only specific groups
gcloud iap web add-iam-policy-binding \
  --resource-type=app-engine \
  --service=default \
  --member="group:engineering@dodatech.com" \
  --role="roles/iap.httpsResourceAccessor"

# Expected output:
# Updated IAM policy for appEngineService.
# Binding members:
#   group:engineering@dodatech.com: roles/iap.httpsResourceAccessor