Terraform Provider for Zscaler Private Access

https://github.com/zscaler/terraform-provider-zpa
Admin
:cloud: Terraform Provider for Zscaler Private Access :cloud:
Tokens:59,427
Snippets:369
Trust Score:8.2
License:MIT
Update:1 year ago
Show doc for...
Tokens:
Raw
### Running Terraform Commands for ZPA Policy Type Example

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_type/README.md

This snippet provides the standard sequence of Terraform commands to initialize the working directory, generate an execution plan, and apply the configuration for the ZPA policy type example. It ensures the necessary provider plugins are downloaded and the infrastructure changes are previewed and then applied.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Example - Bash

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_app_server_controller/README.md

This snippet provides the bash commands to initialize the Terraform working directory, generate an execution plan, and apply the changes to create ZPA application server controller resources.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Installing ZPA Terraform Provider on Windows (CMD)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/README.md

This snippet provides commands for installing the Zscaler Private Access (ZPA) Terraform provider on Windows using the Command Prompt. It navigates to the provider's source directory, formats the Go code, installs the binary, and copies it to the Terraform plugins directory.

```sh
cd %GOPATH%\src\github.com\terraform-providers\terraform-provider-zpa
go fmt
go install
xcopy "%GOPATH%\bin\terraform-provider-zpa.exe" "%APPDATA%\terraform.d\plugins\zscaler.com\zpa\zpa\2.0.5\windows_amd64\" /Y
```

--------------------------------

### Running ZPA Inspection Custom Control Terraform Example

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_inspection_custom_control/README.md

This snippet provides the standard commands to initialize, plan, and apply a Terraform configuration from within its directory. It prepares the working directory, creates an execution plan, and then applies the changes to provision the ZPA application segment resource.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Installing ZPA Terraform Provider on Windows (PowerShell)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/README.md

This snippet provides commands for installing the Zscaler Private Access (ZPA) Terraform provider on Windows using PowerShell. It navigates to the provider's source directory, formats the Go code, installs the binary, and copies it to the Terraform plugins directory, using PowerShell-specific environment variable syntax.

```sh
cd "$env:GOPATH\src\github.com\terraform-providers\terraform-provider-zpa"
go fmt
go install
xcopy "$env:GOPATH\bin\terraform-provider-zpa.exe" "$env:APPDATA\terraform.d\plugins\zscaler.com\zpa\zpa\2.0.5\windows_amd64\" /Y
```

--------------------------------

### Running Terraform Commands for ZPA Browser Access (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment_browser_access/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, generate an execution plan, and apply the configuration for ZPA browser access. It prepares the environment and deploys the defined resources.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Installing Zscaler Terraformer via Homebrew Tap

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This snippet provides the Homebrew commands to install the `zscaler-terraformer` utility on macOS. It first taps the official Zscaler Homebrew repository and then installs the `zscaler-terraformer` formula. This is the recommended installation method for macOS users.

```bash
brew tap zscaler/tap
brew install zscaler/tap/zscaler-terraformer
```

--------------------------------

### Running Terraform Example - Bash

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_rule_reorder/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, create an execution plan, and apply the changes defined in the configuration files. It ensures the necessary plugins are downloaded and the infrastructure is provisioned.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Applying ZPA App Connector Group Configuration with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_app_connector_group/README.md

This snippet initializes Terraform, creates an execution plan, and applies the configuration to deploy or update ZPA App Connector Groups. It's used for setting up the infrastructure.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Applying ZPA Application Segment with Terraform (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment_pra/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, generate an execution plan, and apply the configuration to create a ZPA application segment. It ensures all necessary plugins are downloaded and the infrastructure is provisioned.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Installing Zscaler Terraformer via Homebrew Cask

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This snippet provides an alternative Homebrew command to install the `zscaler-terraformer` utility on macOS using a Cask. It first taps the official Zscaler Homebrew repository and then installs the `zscaler-terraformer` Cask. This method might be used for applications distributed as binaries rather than source.

```bash
brew tap zscaler/tap
brew install --cask zscaler/tap/zscaler-terraformer
```

--------------------------------

### Example ZPA Configuration File for Terraformer

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This snippet shows an example `~/.zscaler-terraformer.yaml` configuration file used to specify ZPA authentication details and cloud information. It includes `zpaClientID`, `zpaClientSecret`, `zpaCustomerID`, and `zpaCloud` parameters. This method provides an alternative to environment variables for configuring `zscaler-terraformer`.

```bash
$ cat ~/.zscaler-terraformer.yaml
```

```yaml
zpaClientID: "Mrwefhoijhviihew"
zpaClientSecret: "{HBRjowhdowqj"
zpaCustomerID: "123456789"
zpaCloud: "BETA"
```

--------------------------------

### Initializing and Applying ZPA LSS Config with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_lss_config_controller/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, create an execution plan, and apply the configuration for the ZPA Log Receiver (LSS Config). It requires a properly configured ZPA provider.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Creating ZPA PRA Portal with Zscaler Managed Certificate (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_pra_portal_controller.md

This example illustrates how to configure a ZPA Privileged Remote Access (PRA) portal using a Zscaler-managed certificate. It defines the portal's name, description, domain, and enables user notifications, utilizing `ext_label`, `ext_domain`, `ext_domain_name`, and `ext_domain_translation` for managed certificate setup.

```terraform
resource "zpa_pra_portal_controller" "this" {
  name                      = "server1.acme.com"
  description               = "server1.acme.com"
  enabled                   = true
  domain                    = "server1-acme.com.pra.d.zscalerportal.net"
  user_notification         = "Created with Terraform"
  user_notification_enabled = true
  ext_label                 = "server1"
  ext_domain                = "acme.com"
  ext_domain_name           = "acme.com.pra.d.zscalerportal.net"
  ext_domain_translation    = "acme.com"
}
```

--------------------------------

### Running Terraform Example for ZPA Portal Creation (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_pra_portal_controller/README.md

This snippet provides the Bash commands to initialize the Terraform configuration, generate an execution plan, and apply the changes to create the ZPA privileged remote access portal. It ensures all necessary provider plugins are downloaded and the infrastructure is provisioned.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Plan and Apply for ZPA Segment Group (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_segment_group/README.md

This snippet initializes the Terraform working directory, generates an execution plan, and applies the changes to create or update ZPA Segment Groups. It ensures the configuration matches the desired state in the ZPA portal.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Applying Terraform Configuration for ZPA Server Group (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_server_group/README.md

This snippet initializes the Terraform working directory, generates an execution plan, and applies the planned changes to create or update resources, specifically a ZPA Server Group. It requires a configured ZPA provider.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Applying ZPA Application Segment with Terraform (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment_inspection/README.md

This snippet demonstrates the standard Terraform workflow to initialize, plan, and apply a ZPA application segment. It prepares the working directory, generates an execution plan, and then applies the changes to create the resources.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Apply for ZPA Application Segment (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment/README.md

This snippet provides the bash commands to initialize Terraform, generate an execution plan, and apply that plan to create or update the ZPA application segment. It ensures the infrastructure defined in the Terraform configuration is provisioned.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying Terraform Resources - Bash

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_app_server_controller/README.md

This snippet provides the bash command to destroy all ZPA application server controller resources managed by Terraform, effectively reverting the applied changes.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA Service Edge Group

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_service_edge_group/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, generate an execution plan, and apply the changes to create or update ZPA Service Edge Group resources. It requires a properly configured ZPA provider.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Applying ZPA Policy Access Inspection Rule with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_inspection_rule/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, generate an execution plan, and apply the configuration to create a ZPA policy access inspection rule. It ensures all necessary plugins are downloaded and the infrastructure is provisioned as defined.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Retrieving ZPA Inspection Profile by Name (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_inspection_profile.md

This Terraform example demonstrates how to retrieve an existing Zscaler Private Access (ZPA) inspection profile using its name. The `zpa_inspection_profile` data source queries the ZPA cloud for a profile named 'Example', making its attributes available for use in other Terraform resources. This is useful for referencing pre-configured profiles without hardcoding their IDs.

```terraform
data "zpa_inspection_profile" "this" {
  name = "Example"
}
```

--------------------------------

### Querying ZPA Posture Profile by Name (SentinelOne)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_posture_profile.md

This example shows how to query a ZPA posture profile named 'Detect SentinelOne'. The `name` argument is required to specify the profile to be retrieved.

```Terraform
data "zpa_posture_profile" "example2" {
 name = "Detect SentinelOne"
}
```

--------------------------------

### Building ZPA Terraform Provider (Windows, Terraform v0.12+)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/README.md

This snippet provides command-line instructions for Windows to navigate into the cloned ZPA Terraform provider directory and use `go fmt` for code formatting and `go install` for building the provider plugin. This process is for Terraform versions 0.12.x and higher on Windows.

```cmd
cd %GOPATH%\src\github.com\terraform-providers\terraform-provider-zpa
go fmt
go install
```

--------------------------------

### Destroying Terraform Resources for ZPA Browser Access (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment_browser_access/README.md

This snippet shows how to destroy all resources previously managed by the Terraform configuration. It's used to clean up the deployed ZPA browser access infrastructure.

```Bash
terraform destroy
```

--------------------------------

### Creating ZPA Policy Access Rule with SCIM Attributes in Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_policy_access_rule_scim_attribute.md

This Terraform example demonstrates how to create a ZPA Policy Access Rule that uses SCIM attribute header conditions. It first retrieves SCIM attribute headers for 'givenName' and 'familyName' using data sources, then defines an access rule named 'Example' with an 'ALLOW' action. The rule's conditions specify that access is granted if the user's 'givenName' is 'John' OR their 'familyName' is 'Smith', combining these with an 'AND' operator at the top level.

```Terraform
data "zpa_scim_attribute_header" "givenName" {
  name     = "name.givenName"
  idp_name = "IdP_Name"
}

data "zpa_scim_attribute_header" "familyName" {
  name     = "name.familyName"
  idp_name = "IdP_Name"
}

resource "zpa_policy_access_rule" "this" {
  name                          = "Example"
  description                   = "Example"
  action                        = "ALLOW"
  operator                      = "AND"

  conditions {
    operator = "OR"
    operands {
      object_type = "SCIM"
      idp_id      = data.zpa_scim_attribute_header.givenName.idp_id
      lhs         = data.zpa_scim_attribute_header.givenName.id
      rhs         = "John"
    }
    operands {
      object_type = "SCIM"
      idp_id      = data.zpa_scim_attribute_header.familyName.idp_id
      lhs         = data.zpa_scim_attribute_header.familyName.id
      rhs         = "Smith"
    }
  }
}
```

--------------------------------

### Destroying ZPA App Connector Group Resources with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_app_connector_group/README.md

This snippet destroys all resources managed by the Terraform configuration, effectively tearing down the ZPA App Connector Group infrastructure. Use with caution.

```bash
terraform destroy
```

--------------------------------

### Creating ZPA Browser Access Certificate Resource (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_ba_certificate.md

This example illustrates how to create a new `zpa_ba_certificate` resource in Terraform. It defines a certificate named `server.example.com` with an optional description. The `cert_blob` argument is crucial, containing the certificate's private key and public certificate in PEM format, which are essential for securing browser access applications.

```terraform
# ZPA Browser Access resource
resource "zpa_ba_certificate" "this" {
    name = "server.example.com"
    description = "server.example.com"
    cert_blob = <<-EOT
-----BEGIN PRIVATE KEY-----
MIIDyzCCArOgA
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDyzCCArOgAwIBAgIUekBD+iu64583B3u5ew7Bqj2O5cQwDQYJKoZIhvcNAQEL
-----END CERTIFICATE-----
    EOT
}
```

--------------------------------

### CLI Usage and Flags for Zscaler Terraformer (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This snippet details the command-line interface for `zscaler-terraformer`, outlining its general usage, available subcommands like `generate` and `import`, and a comprehensive list of flags. These flags control aspects such as configuration file paths, resource filtering, Terraform installation paths, and API credentials for ZPA and ZIA.

```bash
Usage:
  zscaler-terraformer [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  generate    Fetch resources from the Cloudflare API and generate the respective Terraform stanzas
  help        Help about any command
  import      Output `terraform import` compatible commands in order to import resources into state
  version     Print the version number of zscaler-terraformer

Flags:
  -c, --config string                       Path to config file (default "/Users/username/.zscaler-terraformer.yaml")
      --exclude string                      Which resources you wish to exclude
  -h, --help                                help for zscaler-terraformer
      --resource-type string                Which resource you wish to generate
      --resources string                    Which resources you wish to import
      --terraform-install-path string       Path to the default Terraform installation (default ".")
  -v, --verbose                             Specify verbose output (same as setting log level to debug)
      --version                             Display the release version
      --zia-terraform-install-path string   Path to the ZIA Terraform installation (default ".")
      --ziaApiKey string                    ZIA API Key
      --ziaCloud string                     ZIA Cloud (i.e zscalerthree)
      --ziaPassword string                  ZIA password
      --ziaUsername string                  ZIA username
      --zpa-terraform-install-path string   Path to the ZPA Terraform installation (default ".")
      --zpaClientID string                  ZPA client ID
      --zpaClientSecret string              ZPA client secret
      --zpaCloud string                     ZPA Cloud (BETA or PRODUCTION)
      --zpaCustomerID string                ZPA Customer ID

Use "zscaler-terraformer [command] --help" for more information about a command.
```

--------------------------------

### Importing All ZIA Configuration with Terraformer

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This command imports all available ZIA resources using the `zscaler-terraformer` CLI. It instructs the tool to fetch and convert the entire ZIA configuration into Terraform HCL files, typically stored in a local directory. This is useful for migrating existing ZIA setups into Terraform management.

```bash
zscaler-terraformer import --resources="zia"
```

--------------------------------

### Querying ZPA IdP Controller by Name (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_idp_controller.md

This Terraform snippet demonstrates how to retrieve an Identity Provider (IdP) configuration from Zscaler Private Access using its `name`. It defines a `zpa_idp_controller` data source named 'example' and sets the `name` attribute to 'idp_name' to fetch the corresponding IdP details. This is useful for referencing existing IdPs in other ZPA configurations.

```Terraform
# ZPA IdP Controller Data Source
data "zpa_idp_controller" "example" {
 name = "idp_name"
}
```

--------------------------------

### Importing All ZPA Configuration with Terraformer

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This command imports all available ZPA resources using the `zscaler-terraformer` CLI. It instructs the tool to fetch and convert the entire ZPA configuration into Terraform HCL files, typically stored in a local directory. This is useful for migrating existing ZPA setups into Terraform management.

```bash
zscaler-terraformer import --resources="zpa"
```

--------------------------------

### Creating ZPA Inspection Profile with Dynamic Blocks - Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_inspection_profile.md

This example demonstrates how to create a `zpa_inspection_profile` resource using dynamic blocks in Terraform. It fetches all predefined controls for a specific version and group, and also a specific predefined control by name, then configures the inspection profile with these controls and global actions.

```Terraform
data "zpa_inspection_all_predefined_controls" "this" {
  version    = "OWASP_CRS/3.3.0"
  group_name = "Preprocessors"
}

data "zpa_inspection_predefined_controls" "this" {
  name     = "Failed to parse request body"
  version  = "OWASP_CRS/3.3.0"
}

resource "zpa_inspection_profile" "this" {
  name                          = "Example"
  description                   = "Example"
  paranoia_level                = "1"
  predefined_controls_version   = "OWASP_CRS/3.3.0"
  incarnation_number            = "6"
  controls_info {
    control_type = "PREDEFINED"
  }
  dynamic "predefined_controls" {
    for_each = data.zpa_inspection_all_predefined_controls.default_predefined_controls.list
    content {
      id           = predefined_controls.value.id
      action       = predefined_controls.value.action == "" ? predefined_controls.value.default_action : predefined_controls.value.action
      action_value = predefined_controls.value.action_value
    }
  }
  predefined_controls {
    id     = data.zpa_inspection_predefined_controls.this.id
    action = "BLOCK"
  }
  global_control_actions = [
    "PREDEFINED:PASS",
    "CUSTOM:NONE",
    "OVERRIDE_ACTION:COMMON"
  ]
  common_global_override_actions_config = {
    "PREDEF_CNTRL_GLOBAL_ACTION" : "PASS",
    "IS_OVERRIDE_ACTION_COMMON" : "TRUE"
  }
}
```

--------------------------------

### Retrieving ZPA Server Group Information - Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_server_group.md

This Terraform example demonstrates how to use the `zpa_server_group` data source to retrieve information about an existing server group by its name. The `name` argument is required to specify the server group to query. The retrieved data can then be used to configure other ZPA resources.

```Terraform
# ZPA Server Group Data Source
data "zpa_server_group" "example" {
 name = "server_group_name"
}
```

--------------------------------

### Retrieving ZPA PRA Approval Information - Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_pra_approval_controller.md

This Terraform example demonstrates how to use the `zpa_pra_approval_controller` data source to fetch information about a ZPA Privileged Remote Access (PRA) approval. It requires the `email_ids` attribute to specify the email address associated with the approval. The data source will retrieve details such as the approval's ID, start and end times, associated PRA application, working hours, and status.

```Terraform
# ZPA PRA Portal Data Source
data "zpa_pra_approval_controller" "this" {
 email_ids = "jdoe@example.com"
}
```

--------------------------------

### Running Terraform Commands for ZPA Microtenant (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_microtenant_controller/README.md

This snippet demonstrates the standard Terraform workflow to initialize the provider, create an execution plan, and apply the configuration for a ZPA Microtenant. It ensures all necessary plugins are downloaded and the infrastructure is provisioned as defined.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Creating ZPA Inspection Profile with Locals and Dynamic Blocks - Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_inspection_profile.md

This example shows a more advanced method for creating a `zpa_inspection_profile` using Terraform `locals` and dynamic blocks. It defines multiple group names in a local variable, dynamically creates data sources for all predefined controls in those groups, flattens the results, and then uses the combined list to configure the inspection profile.

```Terraform
locals {
  group_names = {
    default_predefined_controls = "preprocessors" // Mandatory and must always be included
    group1 = "Protocol Issues"
    group2 = "Environment and port scanners"
    group3 = "Remote Code Execution"
    group4 = "Remote file inclusion"
    group5 = "Local File Inclusion"
    group6 = "Request smuggling or Response split or Header injection"
    group7 = "PHP Injection"
    group8 = "XSS"
    group9 = "SQL Injection"
    group10 = "Session Fixation"
    group11 = "Deserialization Issues"
    group12 = "Anomalies"
    group13 = "Request smuggling or Response split or Header injection"
  }
}

# Dynamically create data sources using for_each
data "zpa_inspection_all_predefined_controls" "all" {
  for_each = local.group_names
  group_name = each.value
}

# Combine the data source results into a single list
locals {
  combined_predefined_controls = flatten([
    for ds in data.zpa_inspection_all_predefined_controls.all : ds.list
  ])
}

resource "zpa_inspection_profile" "example" {
  name           = "Example"
  description    = "Example"
  paranoia_level = "2"
  incarnation_number = "6"
  controls_info {
    control_type = "PREDEFINED"
  }

  dynamic "predefined_controls" {
    for_each = local.combined_predefined_controls
    content {
      id     = predefined_controls.value.id
      action = predefined_controls.value.action == "" ? predefined_controls.value.default_action : predefined_controls.value.action
    }
  }
  global_control_actions = [
    "PREDEFINED:PASS",
    "CUSTOM:NONE",
    "OVERRIDE_ACTION:COMMON"
  ]
}
```

--------------------------------

### Retrieving ZPA PRA Portal Information - Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_pra_portal_controller.md

This Terraform snippet demonstrates how to use the `zpa_pra_portal_controller` data source to retrieve configuration details of an existing ZPA Privileged Remote Access (PRA) portal. It queries the portal by its `name` attribute, set to "Example", allowing other Terraform resources to reference the fetched portal's properties, such as its ID or description. This is typically used to fetch pre-configured portals for use in console resources.

```terraform
# ZPA PRA Portal Data Source
data "zpa_pra_portal_controller" "this" {
 name = "Example"
}
```

--------------------------------

### Destroying ZPA Inspection Custom Control Terraform Resources

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_inspection_custom_control/README.md

This command is used to de-provision all resources managed by the Terraform configuration. It prompts for confirmation before destroying the ZPA application segment and related resources created by the example.

```Bash
terraform destroy
```

--------------------------------

### Configuring ZPA LSS for App Connector Metrics using Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_lss_config_controller.md

This Terraform example demonstrates how to configure the ZPA Log Streaming Service (LSS) to stream App Connector Metrics (`zpn_ast_comprehensive_stats`) to an external SIEM. It retrieves necessary data for log type format, SIEM policy, and an App Connector Group by name. The `zpa_lss_config_controller` resource then defines the LSS configuration, including the SIEM host and port, enabling TLS, and associating it with the specified App Connector Group. This setup ensures that App Connector performance and status logs are forwarded for monitoring and analysis.

```terraform
# Get Log Type Format - "App Connector Metrics"
data "zpa_lss_config_log_type_formats" "zpn_ast_comprehensive_stats" {
  log_type = "zpn_ast_comprehensive_stats"
}

data "zpa_policy_type" "lss_siem_policy" {
  policy_type = "SIEM_POLICY"
}

data "zpa_app_connector_group" "this" {
 name = "Example100"
}
resource "zpa_lss_config_controller" "lss_app_connector_metrics" {
  config {
    name            = "LSS App Connector Metrics"
    description     = "LSS App Connector Metrics"
    enabled         = true
    format          = data.zpa_lss_config_log_type_formats.zpn_ast_comprehensive_stats.json
    lss_host        = "splunk1.acme.com"
    lss_port        = "5001"
    source_log_type = "zpn_ast_comprehensive_stats"
    use_tls         = true
  }
  connector_groups {
    id = [ data.zpa_app_connector_group.this.id ]
  }
}
```

--------------------------------

### Destroying ZPA Segment Group Resources with Terraform (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_segment_group/README.md

This snippet executes the Terraform destroy command, which removes all resources managed by the current Terraform configuration, effectively deleting the ZPA Segment Groups created by the example.

```bash
terraform destroy
```

--------------------------------

### Querying ZPA IdP Controller by ID (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_idp_controller.md

This Terraform snippet illustrates how to retrieve an Identity Provider (IdP) configuration from Zscaler Private Access using its unique `id`. It defines a `zpa_idp_controller` data source named 'example' and sets the `id` attribute to '1234567890' to fetch the specific IdP details. This method is suitable when the exact ID of the IdP is known.

```Terraform
# ZPA IdP Controller Data Source
data "zpa_idp_controller" "example" {
 id = "1234567890"
}
```

--------------------------------

### Applying Terraform Configuration for ZPA Access Policy

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_rule/README.md

This snippet outlines the essential `terraform` commands to initialize the project, preview changes, and apply the configuration to create a ZPA access policy rule. It requires the ZPA provider to be pre-configured.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Creating ZPA Policy Forwarding Rule V2 with Dependencies - Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_policy_forwarding_rule_v2.md

This example demonstrates the creation of a `zpa_policy_forwarding_rule_v2` resource, showcasing how to define complex conditions. It includes retrieving necessary data such as Identity Provider IDs, SAML Attribute IDs, and SCIM Group IDs, as well as creating a segment group, all of which are then referenced within the forwarding rule's conditions to specify access policies.

```terraform
# Retrieve Identity Provider ID
data "zpa_idp_controller" "this" {
	name = "Idp_Name"
}

# Retrieve SAML Attribute ID
data "zpa_saml_attribute" "email_user_sso" {
    name = "Email_Users"
    idp_name = "Idp_Name"
}

# Retrieve SAML Attribute ID
data "zpa_saml_attribute" "group_user" {
    name = "GroupName_Users"
    idp_name = "Idp_Name"
}

# Retrieve SCIM Group ID
data "zpa_scim_groups" "a000" {
    name = "A000"
    idp_name = "Idp_Name"
}

# Retrieve SCIM Group ID
data "zpa_scim_groups" "b000" {
    name = "B000"
    idp_name = "Idp_Name"
}

# Create Segment Group
resource "zpa_segment_group" "this" {
   name = "Example"
   description = "Example"
   enabled = true
 }

# Create Policy Access Rule V2
resource "zpa_policy_forwarding_rule_v2" "this" {
  name                  = "Example"
  description           = "Example"
  action                = "BYPASS"

  conditions {
    operator = "OR"
    operands {
      object_type = "APP_GROUP"
      values      = [zpa_segment_group.this.id]
    }
  }

  conditions {
    operator = "OR"
    operands {
      object_type = "SAML"
      entry_values {
        rhs = "user1@acme.com"
        lhs = data.zpa_saml_attribute.email_user_sso.id
      }
      entry_values {
        rhs = "A000"
        lhs = data.zpa_saml_attribute.group_user.id
      }
    }
    operands {
      object_type = "SCIM_GROUP"
      entry_values {
        rhs = data.zpa_scim_groups.a000.id
        lhs = data.zpa_idp_controller.this.id
      }
      entry_values {
        rhs = data.zpa_scim_groups.b000.id
        lhs = data.zpa_idp_controller.this.id
      }
    }
  }
  conditions {
    operator = "OR"
    operands {
      object_type = "PLATFORM"
      entry_values {
        rhs = "true"
        lhs = "linux"
      }
      entry_values {
        rhs = "true"
        lhs = "android"
      }
    }
  }
}
```

--------------------------------

### Terraform Error: Failed Provider Installation Due to Checksum Mismatch

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/troubleshooting.md

This error indicates that Terraform failed to install the `zscaler/zpa` provider because the checksum list does not contain a SHA-256 hash for the specified release. This often happens when the `.terraform.lock.hcl` file is not committed to version control or is out of sync with the provider's release artifacts.

```sh
Error: Failed to install provider

Error while installing zscaler/zpa: v2.82.0: checksum list has no SHA-256 hash for "https://github.com/zscaler/terraform-provider-zpa/releases/download/v2.82.0/terraform-provider-zpa_2.82.0_darwin_amd64.zip"
```

--------------------------------

### Setting ZIA Install Path and Generating Firewall Rule

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This snippet demonstrates how to specify a custom installation path for generated ZIA Terraform configurations using the `ZSCALER_ZIA_TERRAFORM_INSTALL_PATH` environment variable. Following this, it generates the HCL configuration for `zia_firewall_filtering_rule` resources, placing the output in the specified directory. This allows for organized storage of generated Terraform files.

```bash
$ export ZSCALER_ZIA_TERRAFORM_INSTALL_PATH="$HOME/Desktop/zia_configuration"
$ zscaler-terraformer generate \
  --resource-type "zia_firewall_filtering_rule"
```

--------------------------------

### Creating ZPA Policy Access Rule and Browser Access with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_policy_access_rule_browser_access.md

This Terraform example demonstrates how to create a ZPA Policy Access Rule and a ZPA Browser Access resource. It first retrieves IdP and SCIM Group IDs using data sources, then defines an access rule with conditions based on application segments, client types, and SCIM groups, and finally configures a browser access segment with associated server groups.

```Terraform
// Get IdP ID
data "zpa_idp_controller" "idp_name" {
 name = "IdP_Name"
}

// Get SCIM Group attribute ID
data "zpa_scim_groups" "engineering" {
  name = "Engineering"
  idp_name = "IdP_Name"
}

// Create
resource "zpa_policy_access_rule" "this" {
  name                          = "Example"
  description                   = "Example"
  action                        = "ALLOW"
  operator                      = "AND"

  conditions {
    operator = "OR"
    operands {
      object_type = "APP"
      lhs = "id"
      rhs = zpa_application_segment.this.id
    }
  }

  conditions {
    operator = "OR"
    operands {
      object_type = "CLIENT_TYPE"
      lhs = "id"
      rhs = "zpn_client_type_exporter"
    }
  }

  conditions {
    operator = "OR"
    operands {
      object_type = "SCIM_GROUP"
      lhs = data.zpa_idp_controller.idp_name.id
      rhs = data.zpa_scim_groups.engineering.id
    }
  }
}

# ZPA Application Segment resource
resource "zpa_browser_access" "this" {
    name              = "Example"
    description       = "Example"
    enabled           = true
    health_reporting  = "ON_ACCESS"
    bypass_type       = "NEVER"
    is_cname_enabled  = true
    tcp_port_ranges   = ["8080", "8080"]
    domain_names      = ["server.acme.com"]
    segment_group_id  = zpa_segment_group.this.id
    server_groups {
        id = [ zpa_server_group.this.id]
    }
}
```

--------------------------------

### Setting ZPA Install Path and Generating Application Segment

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/guides/resource-importer.md

This snippet demonstrates how to specify a custom installation path for generated ZPA Terraform configurations using the `ZSCALER_ZPA_TERRAFORM_INSTALL_PATH` environment variable. Following this, it generates the HCL configuration for `zpa_application_segment` resources, placing the output in the specified directory. This allows for organized storage of generated Terraform files.

```bash
$ export ZSCALER_ZPA_TERRAFORM_INSTALL_PATH="$HOME/Desktop/zpa_configuration"
$ zscaler-terraformer generate \
  --resource-type "zpa_application_segment"
```

--------------------------------

### Initializing and Applying Terraform Configuration

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_rule_v2/README.md

This snippet initializes the Terraform working directory, generates an execution plan, and applies the planned changes to create resources. It requires the ZPA provider to be configured as per the documentation.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Creating ZPA Browser Access Application Segment with Zscaler Managed Certificate (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_application_segment_browser_access.md

This example illustrates how to set up a ZPA Browser Access Application Segment utilizing a Zscaler managed certificate. It defines the application segment with similar attributes to the custom certificate example but configures the `clientless_apps` block to use HTTPS on port 443, without explicitly referencing a `certificate_id` (implying Zscaler managed or default behavior), and includes `ext_label` and `ext_domain` for external access. Dependencies are similar: `zpa_ba_certificate`, `zpa_segment_group`, `zpa_server_group`, and `zpa_app_connector_group` resources/data sources.

```Terraform
# Retrieve Browser Access Certificate
data "zpa_ba_certificate" "test_cert" {
  name = "sales.acme.com"
}

# Create Browser Access Application
resource "zpa_application_segment_browser_access" "browser_access_apps" {
    name                      = "Browser Access Apps"
    description               = "Browser Access Apps"
    enabled                   = true
    health_reporting          = "ON_ACCESS"
    bypass_type               = "NEVER"
    tcp_port_ranges           = ["443", "443"]
    domain_names              = ["sales.acme.com"]
    segment_group_id          = zpa_segment_group.example.id

    clientless_apps {
        name                  = "app-ba01.acme.com"
        application_protocol  = "HTTPS"
        application_port      = "443"
        trust_untrusted_cert  = true
        enabled               = true
        domain                = "app-ba01.acme.com"
        ext_label             = "app-ba01"
        ext_domain            = "acme.com"
    }
    server_groups {
        id = [zpa_server_group.example.id]
    }
}

# ZPA Segment Group resource
resource "zpa_segment_group" "example" {
  name          = "Example"
  description   = "Example"
  enabled       = true
}

# ZPA Server Group resource
resource "zpa_server_group" "example" {
  name                  = "Example"
  description           = "Example"
  enabled               = true
  dynamic_discovery     = true
  app_connector_groups {
    id = [ data.zpa_app_connector_group.example.id ]
  }
}

data "zpa_app_connector_group" "example" {
  name = "AWS-Connector"
}
```

--------------------------------

### Destroying ZPA Application Segment with Terraform (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment_pra/README.md

This snippet shows how to destroy the ZPA application segment resources provisioned by Terraform. It removes all managed infrastructure, cleaning up the environment.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA Trusted Networks (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_trusted_network/README.md

This snippet provides the standard command-line steps to initialize, plan, and apply a Terraform configuration. It's used to deploy or update ZPA Trusted Network resources as defined in the Terraform configuration files. The `terraform init` command initializes the working directory, `terraform plan` creates an execution plan, and `terraform apply` executes the planned changes.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Initializing and Applying Terraform Configuration

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_provisioning_key/README.md

This snippet initializes the Terraform working directory, creates an execution plan, and applies the changes defined in the plan to create or update resources. It's a standard workflow for deploying infrastructure.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying ZPA LSS Config Resources with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_lss_config_controller/README.md

This snippet shows how to destroy all resources managed by the Terraform configuration for the ZPA Log Receiver (LSS Config). This action is irreversible and removes all provisioned infrastructure.

```Bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for Policy Set Rule Creation (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_rule_trusted_network/README.md

This snippet outlines the standard Terraform workflow to initialize the provider, generate an execution plan, and apply the configuration to create a ZPA policy set rule. It ensures the necessary plugins are downloaded and the infrastructure changes are previewed and then deployed.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying ZPA Application Segment with Terraform (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment_inspection/README.md

This snippet shows how to use Terraform to destroy the ZPA application segment resources previously created. It removes all managed infrastructure defined in the configuration.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA Posture Profile Retrieval

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_posture_profile/README.md

This snippet provides the standard Terraform commands required to initialize the working directory, generate an execution plan, and apply the configuration to retrieve a ZPA Posture Profile. It ensures the necessary provider plugins are downloaded and the infrastructure changes are previewed and then enacted.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Initializing and Applying ZPA Cloud Browser Isolation External Profile with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_cloud_browser_isolation_external_profile/README.md

This snippet demonstrates the standard Terraform workflow to initialize the provider, create an execution plan, and apply the configuration for a ZPA Cloud Browser Isolation External Profile. It ensures all necessary plugins are downloaded and the desired state is achieved.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying ZPA Service Edge Group Resources with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_service_edge_group/README.md

This snippet shows how to destroy all resources managed by the Terraform configuration for the ZPA Service Edge Group. This action is irreversible and will remove the provisioned infrastructure.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA Customer Version Profile

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_customer_version_profile/README.md

This snippet demonstrates the standard Terraform workflow to initialize the provider, create an execution plan, and apply the configuration. It's used to deploy or manage ZPA resources, specifically for retrieving customer version profiles, after the ZPA provider has been configured.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Plan and Apply for ZPA Policy Rule (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_forwarding_rule/README.md

This snippet initializes the Terraform working directory, generates an execution plan, and applies the changes to create a ZPA policy forwarding rule. It requires a configured ZPA provider as described in the documentation.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Initialize and Apply ZPA Terraform Configuration

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_rule_crwd_pre_zta_scim_group/README.md

This snippet initializes the Terraform working directory, creates an execution plan, and applies the planned changes to configure ZPA resources. It ensures all necessary plugins and modules are downloaded and the infrastructure is provisioned as defined.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying Terraform Resources for ZPA Application Segment (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_application_segment/README.md

This snippet executes the 'terraform destroy' command, which deprovisions all resources managed by the current Terraform configuration. It is used to clean up the ZPA application segment and associated infrastructure.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA IdP Controller

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_idp_controller/README.md

This snippet demonstrates the standard Terraform workflow to initialize the provider, create an execution plan, and apply the configuration to retrieve an IdP Controller ID. It requires the ZPA provider to be configured as described in the documentation.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Querying ZPA Posture Profile with Cloud Name

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/data-sources/zpa_posture_profile.md

This example demonstrates how to query a posture profile associated with a specific Zscaler cloud. It requires appending the cloud name in parentheses to the posture profile's name for consistent search results.

```Terraform
data "zpa_posture_profile" "example1" {
 name = "CrowdStrike_ZPA_ZTA_40 (zscalertwo.net)"
}
```

--------------------------------

### Destroying Terraform Resources for ZPA Server Group (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_server_group/README.md

This snippet executes the Terraform destroy command, which removes all resources previously managed by the Terraform configuration, including the ZPA Server Group. It requires prior successful application of the configuration.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for Browser Access Certificate

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_ba_certificate/README.md

This snippet provides the standard Terraform commands to initialize the working directory, generate an execution plan, and apply the configuration to retrieve a Browser Access Certificate. It assumes the ZPA provider is already configured.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Commands for ZPA SCIM Attribute Header

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_scim_attribute_header/README.md

This snippet outlines the standard Terraform workflow to initialize the provider, create an execution plan, and apply the configuration to retrieve a ZPA SCIM Attribute Header. It ensures the necessary provider plugins are downloaded and the desired state is achieved.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying ZPA Policy Set Rule with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_rule_crwd_pre_zta_saml/README.md

This snippet destroys all resources managed by the current Terraform configuration, including the ZPA policy set rules created in the example. It should be used with caution as it permanently removes resources.

```bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA Machine Group Retrieval (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_machine_group/README.md

This snippet provides the standard Terraform commands to initialize the working directory, generate an execution plan, and apply the configuration. These steps are essential for retrieving and managing ZPA Machine Groups, ensuring the provider is set up and changes are applied.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Commands for Cloud Browser Isolation Region Retrieval

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_cloud_browser_isolation_region/README.md

This snippet provides the standard Terraform commands to initialize the working directory, generate an execution plan, and apply the configuration. These steps are essential for deploying or updating ZPA Cloud Browser Isolation configurations.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Running Terraform Commands for SCIM Group Retrieval

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_scim_groups/README.md

This snippet provides the standard Terraform workflow commands to initialize the provider, create an execution plan, and apply the configuration. It's used to manage ZPA resources, specifically for retrieving SCIM Groups as part of a larger configuration.

```bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Applying Terraform Configuration for ZPA Certificate Retrieval (Bash)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_enrollment_cert/README.md

This snippet demonstrates the standard Terraform workflow to initialize the working directory, generate an execution plan, and apply the configuration to retrieve ZPA enrollment certificate details. It requires a pre-configured ZPA provider.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Destroying ZPA Policy Access Inspection Rule with Terraform

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_policy_access_inspection_rule/README.md

This snippet shows how to use Terraform to destroy the previously provisioned ZPA policy access inspection rule resource. It removes all resources managed by the current Terraform configuration, effectively cleaning up the environment.

```Bash
terraform destroy
```

--------------------------------

### Running Terraform Commands for ZPA CBI Certificate

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/examples/zpa_cloud_browser_isolation_certificate/README.md

This snippet demonstrates the standard workflow for applying Terraform configurations. It initializes the working directory, generates an execution plan, and then applies the planned changes to create or update the ZPA Cloud Browser Isolation Certificate.

```Bash
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Cloning ZPA Terraform Provider Repository (Windows)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/README.md

This snippet provides command-line instructions for Windows to create the required directory structure and clone the Zscaler Private Access (ZPA) Terraform provider repository into the Go workspace. This step is essential before building the provider on a Windows environment.

```cmd
mkdir %GOPATH%\src\github.com\terraform-providers
cd %GOPATH%\src\github.com\terraform-providers
git clone https://github.com/zscaler/terraform-provider-zpa.git
```

--------------------------------

### Creating ZPA Policy Redirection Rule with REDIRECT_PREFERRED Action (Terraform)

Source: https://github.com/zscaler/terraform-provider-zpa/blob/master/docs/resources/zpa_policy_redirection_rule.md

This example illustrates creating a ZPA policy redirection rule with the `REDIRECT_PREFERRED` action. It first retrieves a `zpa_service_edge_group` by name and then associates the rule with this specific service edge group, applying the preferred redirection for branch connectors.

```Terraform
data "zpa_service_edge_group" "this" {
    name = "Service_Edge_Group01
}

resource "zpa_policy_redirection_rule" "this" {
  name                          = "Example"
  description                   = "Example"
  action                        = "REDIRECT_PREFERRED"

  conditions {
    operator = "OR"
    operands {
      object_type = "CLIENT_TYPE"
      values      = ["zpn_client_type_branch_connector"]
    }
}
  service_edge_groups {
    id = [ data.zpa_service_edge_group.this.id ]
  }
}
```
Tokens:
Raw