JA EN
shiichan

Cloud Workload Security Is in Beta: Guard Cloud API Requests Before They Arrive!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's Shii-chan! Today I'm introducing a new Cloudflare Beta feature that could help prevent cloud misconfigurations.

Cloudflare Changelog developers.cloudflare.com

What was announced?

In the Cloudflare Changelog, Cloudflare announced that Cloud Workload Security (CWS) is now available in Beta. It lets you apply policy controls to cloud API requests before they reach your cloud provider.

Why it matters

Cloud API requests can also be the entry point for risky configurations. If you can check requests before they reach the provider, you can stop problematic operations up front. That's the idea behind CWS.

What changes

The example in the post is a policy that blocks requests that would make an R2 bucket public. If you want certain rules enforced at the request level in your cloud environments, this gives you a way to do it.

Dive Deep

Here is what the post tells us about how it works:

  • Defining policies: write them with request filters and Rego checks
  • Targeting: use workloads and policy sets to target your cloud environments
  • Management: manage policies in the Cloudflare dashboard
  • Enforcement: run the CWS proxy in your environment and route client requests through it

CWS requires a Zero Trust subscription, and the Zero Trust Free plan is sufficient. To configure your first guardrail, see the "Get started with Cloud Workload Security" guide.

Wrap-up

  • CWS is now available in Beta
  • You can apply policies to cloud API requests before they reach your cloud provider
  • Policies use request filters and Rego, and are managed in the dashboard
  • Requests are enforced by routing them through the CWS proxy
  • The Zero Trust Free plan is enough

If you want to stop risky cloud operations at the request stage, this one is for security and infrastructure folks!

Related posts