JA EN
shiichan

No more all-or-nothing access: Access resource lists now respect scoped roles!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#devops

Hi, it's me! Today I found a small-but-useful update to Cloudflare Access that should make life easier for anyone managing permissions. Let's take a look!

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog announced that "Access resource lists now support resource-scoped roles." Cloudflare Access is Cloudflare's Zero Trust access control service, letting you manage resources like applications, policies, service tokens, and identity providers. This update reworks who's allowed to view those resource lists.

The story so far

Until now, members with only resource-scoped Access roles couldn't open the resource list pages in the dashboard, and calling the list endpoints in the API returned 403 responses. To see a resource list at all, they also needed an additional account-scoped, read-only role — meaning you had to grant account-wide visibility just to let someone see a handful of resources.

What changes

Members with only resource-scoped Access roles can now open resource list pages in the dashboard and call list endpoints in the API. Both the dashboard and the API return only the resources included in that member's permission policy scopes. This applies to four resource types:

  • Access applications
  • Policies
  • Service tokens
  • Identity providers

Administrators can now delegate specific Access resources to a member without granting account-wide visibility.

Dive Deep

Policy lists behave a bit differently depending on the role:

  • Members with the Cloudflare Access App Admin role see policies attached directly to the selected application
  • Members with the Cloudflare Access Policy Admin role also see reusable policies

For the full role definitions and assignment rules, check the "Resource-scoped roles" and "Role scopes" docs before you design your permission setup.

Wrap-up

  • Members with resource-scoped Access roles can now view resource lists and call list endpoints without an extra account-wide role
  • Applies to Access applications, policies, service tokens, and identity providers
  • Results are filtered to the member's own permission policy scopes
  • App Admin and Policy Admin roles see slightly different policy lists
  • Great for admins who want to delegate specific Access resources without handing over account-wide visibility

Related posts