Cloudflare Access for Infrastructure Can Now Control Access by Tag!
Hello, I'm Shii-chan! Today's news makes access control in Cloudflare One more flexible. Let's check it out!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
This comes from the Cloudflare Changelog. Access for Infrastructure now integrates with Resource Tagging, so you can attach key-value tags to infrastructure targets and use those tags in access policies.
The story so far
Until now, hostnames were pretty much the only way to scope targets in Access for Infrastructure. There was no way to classify targets with tags or build access policies around them.
What changes
You can manage tags in two ways.
- Inline, when you create or edit a target
- Through the centralized Resource Tagging API
Whichever method you use, Cloudflare keeps tags in sync automatically.
Infrastructure applications also gain a target criteria model with three operators. Each one can match targets by hostname, tag, or both.
- include — matches targets that have any of the specified values
- require — matches targets that have all of the specified values
- exclude — rejects targets that have any of the specified values
Combine these operators and you can express conditions like "hosts tagged production that also expose SSH."
Wrap-up
- Access for Infrastructure now integrates with Resource Tagging, so you can tag infrastructure targets
- Tags can be managed inline or via the central Resource Tagging API, and stay in sync either way
- The new include/require/exclude operators let you combine hostname and tag matching for finer-grained access control
A nice upgrade if you want to organize infrastructure access policies by environment or team using tags!
