diff --git a/docs/administration/index.md b/docs/administration/index.md index 75d0c0c..2f238ac 100644 --- a/docs/administration/index.md +++ b/docs/administration/index.md @@ -6,5 +6,6 @@ Platform administration guides for managing workspaces, accounts, and platform r - [Account Management](account-management.md) - User accounts, organizations, and role-based access control - [Workspace Management](workspace.md) - Creating and managing workspaces and folders +- [IP Restriction](ip-restriction.md) - IP allowlists at the organization, folder, and application levels - [Data Retention](data-retention.md) - Data retention policies and compliance - [Support](support.md) - Getting help and support resources diff --git a/docs/administration/ip-restriction.md b/docs/administration/ip-restriction.md new file mode 100644 index 0000000..3f40a6b --- /dev/null +++ b/docs/administration/ip-restriction.md @@ -0,0 +1,77 @@ +# IP Restriction + +IP restriction lets you define an IP allowlist that controls which client IPs can reach your resources. +Requests whose client IP does not match the configured CIDR blocks are rejected at the routing layer, before they reach any application. + +You can apply IP restriction at three levels, matching the [account hierarchy](account-management) (Organization → Folder → Workspace, with applications running inside workspaces): + +- **Organization** — applies to every workspace in the organization. +- **Folder** — applies to every workspace in a folder. +- **Application** — applies to a single application. + +Organization- and folder-level restrictions are managed through the [Tailor Platform Terraform provider](https://registry.terraform.io/providers/tailor-platform/tailor/latest) (version `>= 2.16.0`). Application-level restriction is configured in the [application manifest](/guides/application). + +## How the layers combine + +When more than one layer is configured, a request must satisfy **all** of them — the layers compose with **AND**. For example, if both an organization-level and a folder-level rule exist, the client IP must match both allowlists to reach a workspace in that folder. A layer with no rule configured imposes no restriction at that level. + +## Organization level + +Use [`tailor_organization_ip_restriction`](https://registry.terraform.io/providers/tailor-platform/tailor/latest/docs/resources/organization_ip_restriction) to apply an allowlist across every workspace in the organization. + +```hcl {{ label: "organization_ip_restriction.tf" }} +resource "tailor_organization_ip_restriction" "this" { + organization_id = "" + allowed_ip_addresses = [ + "203.0.113.10/32", # a single public IP + "198.51.100.0/24", # a public subnet range + ] +} +``` + +| Argument | Type | Description | +| ---------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `organization_id` | String | The ID of the organization. Changing this forces replacement of the resource. **(required)** | +| `allowed_ip_addresses` | List of String | List of allowed IPv4/IPv6 addresses or CIDR blocks. Each entry must be a **public** address; private, loopback, and multicast ranges are rejected. **(required)** | + +## Folder level + +Use [`tailor_organization_folder_ip_restriction`](https://registry.terraform.io/providers/tailor-platform/tailor/latest/docs/resources/organization_folder_ip_restriction) to apply an allowlist to every workspace in a [folder](account-management#folders). This composes with any organization-level rule (AND). + +```hcl {{ label: "organization_folder_ip_restriction.tf" }} +resource "tailor_organization_folder_ip_restriction" "this" { + organization_id = "" + folder_id = "" + allowed_ip_addresses = [ + "203.0.113.10/32", + "198.51.100.0/24", + ] +} +``` + +| Argument | Type | Description | +| ---------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `organization_id` | String | The ID of the organization that owns the folder. Changing this forces replacement of the resource. **(required)** | +| `folder_id` | String | The ID of the folder. Changing this forces replacement of the resource. **(required)** | +| `allowed_ip_addresses` | List of String | List of allowed IPv4/IPv6 addresses or CIDR blocks. Each entry must be a **public** address; private, loopback, and multicast ranges are rejected. **(required)** | + +## Application level + +To restrict access to a single application, set [`AllowedIPAddresses`](/guides/application) in the application manifest. This applies on top of any organization- and folder-level rules. + +## Provider configuration + +The organization- and folder-level resources require the Tailor Platform Terraform provider: + +```hcl {{ label: "provider.tf" }} +terraform { + required_providers { + tailor = { + source = "tailor-platform/tailor" + version = ">= 2.16.0" + } + } +} + +provider "tailor" {} +``` diff --git a/docs/guides/application.md b/docs/guides/application.md index f9e4bc9..7d43c5c 100644 --- a/docs/guides/application.md +++ b/docs/guides/application.md @@ -13,7 +13,7 @@ In the spec property, the following child properties can be defined: - `Name`: The gateway name. Name of the gateway that will be used as the application's subdomain, e.g. setting `Name` to `my-app` will create API endpoints at `my-app-{WORKSPACE_HASH}.erp.dev/query`. Cannot duplicate a NAME that is being used by other users. **(required)** - `Cors`: The origins. Defines the origin to which requests are allowed. -- `AllowedIPAddresses`: A list of IP addresses authorized to access the application, preventing unauthorized access. Each entry is a string in the format CIDR. Example: `["1.1.1.1/32", "2.2.2.0/24"]`. +- `AllowedIPAddresses`: A list of IP addresses authorized to access the application, preventing unauthorized access. Each entry is a string in the format CIDR. Example: `["1.1.1.1/32", "2.2.2.0/24"]`. To restrict access more broadly across an organization or folder, see [IP Restriction](/administration/ip-restriction). - `Auth`: The authentication service. Defines the authentication service to be used. - `Subgraphs`: The services you use.