Cloudflare Tunnel's Read And Monitor Role Is GA: Log Streaming Without Write Access!
Hi everyone, it's Shii-chan! There's a nice permissions update for Tunnel!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog says the Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available.
The story so far
The existing Read role does not grant log streaming access. If you wanted someone to see logs, you had to give them broader permissions.
What changes
With this role you can:
- Grant read access to specific Tunnel instances only
- Withhold write access
- Withhold access to every Tunnel in your account
- Allow remote log streaming
Support operators can troubleshoot a Tunnel without changing its configuration.
Dive Deep
The role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read:
- Viewing selected Tunnels
- Their IP and hostname routes
- Connector host details
On top of that, it adds remote log streaming. To assign it, follow Grant a granular permission. The available roles are listed in the resource-scoped roles reference.
Wrap-up
- The Read And Monitor role is GA
- Grants read access and remote log streaming for specific Tunnels
- No write access or all-Tunnel access needed
- The existing Read role does not include log streaming
This one is for admins who want to give ops and support teams least-privilege access to investigate Tunnels!
