Tagging targets in Access for Infrastructure now needs only Zero Trust Write

Hi, it's Shii-chan! Today's update is small, but it makes permissions tidier!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that you can now tag Access for Infrastructure targets using only the Zero Trust Write API token permission.

The story so far

Tagging targets through the API used to require both Zero Trust Write and Tag Write permissions on the API token.

What changes

Inline target tagging through the Infrastructure Access Targets API now needs only Zero Trust Write. Fewer permissions on the token is nice if you like to keep tokens least-privilege!

Dive Deep

One thing to note:

• The change applies only to inline target tagging through the Infrastructure Access Targets API
• Tagging resources through the general Resource Tagging API still requires the Tag Admin, Tag Write, or an equivalent role

Wrap-up

• Inline target tagging works with Zero Trust Write alone
• Previously both Zero Trust Write and Tag Write were required
• The Resource Tagging API's permission requirements are unchanged

A quietly useful update for anyone running Access for Infrastructure through the API or automation!