Skip to content

Commit 4595cc7

Browse files
marciocloudflarepedrosousa
marciocloudflare
and
pedrosousa
authored
[Rules] Cloud connector (#16088)
* [Rules] Add Cloud Connector docs * Incorporate received feedback * More feedback * Reorder first-level nav items (use dash order) * Remove R2 for now * Review supported provider URL formats * added changes * corrected text * refined text * corrected page weights --------- Co-authored-by: Pedro Sousa <[email protected]>
1 parent 530979a commit 4595cc7

File tree

14 files changed

+289
-7
lines changed

14 files changed

+289
-7
lines changed

‎content/fundamentals/_partials/_zone-permissions-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ inputParameters: editWord
2222
| Cache Purge | Grants access to [purge cache](/cache/how-to/purge-cache/). |
2323
| Cache Rules Read | Grants read access to [Cache Rules](/cache/how-to/cache-rules/). |
2424
| Cache Rules $1 | Grants write access to [Cache Rules](/cache/how-to/cache-rules/). |
25+
| Cloud Connector Read | Grants read access to [Cloud Connector rules](/rules/cloud-connector/). |
26+
| Cloud Connector $1 | Grants write access to [Cloud Connector rules](/rules/cloud-connector/). |
2527
| Config Rules Read | Grants read access to [Configuration Rules](/rules/configuration-rules/). |
2628
| Config Rules $1 | Grants write access to [Configuration Rules](/rules/configuration-rules/). |
2729
| Custom Errors Read | Grants read access to [Custom Errors Phase](/rules/custom-error-responses/create-api/). |

‎content/rules/cache-rules.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: navigation
33
title: Cache Rules
44
external_link: /cache/how-to/cache-rules/
5-
weight: 6
5+
weight: 7
66
_build:
77
publishResources: false
88
render: never

‎content/rules/cloud-connector/_index.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
title: Cloud Connector
3+
pcx_content_type: concept
4+
weight: 8
5+
---
6+
7+
{{<heading-pill style="beta">}}Cloud Connector{{</heading-pill>}}
8+
9+
Cloud Connector allows you to route matching incoming traffic from your website to a public cloud provider that you define such as AWS, Google Cloud, and Azure. With Cloud Connector you can make Cloudflare the control center for your web traffic, including traffic served from public cloud providers, without having to configure additional rules.
10+
11+
{{<Aside type="note">}}
12+
We are gradually rolling out access to Cloud Connector throughout 2024. Refer to [Availability](#availability) for details. Support for Cloudflare R2 will be added soon.
13+
{{</Aside>}}
14+
15+
## How it works
16+
17+
First, you configure a Cloud Connector rule that specifies:
18+
- The cloud provider and a supported cloud service that will accept traffic.
19+
- The traffic that will be routed to that cloud service.
20+
21+
Then, Cloudflare will create the [necessary configurations](#applied-configurations) so that the content is accessible for requests matching your Cloud Connector rule.
22+
23+
Cloud Connector rules are evaluated last in the request evaluation workflow. When there is a rule match and you have other rules changing the same settings, the Cloud Connector rule will win over other rules.
24+
25+
## Applied configurations
26+
27+
Cloud Connector will perform the following configurations automatically, depending on the cloud provider:
28+
* Modify the `Host` header.
29+
* Adjust SSL/TLS for bucket-related traffic (AWS S3 only).
30+
31+
## Availability
32+
33+
Cloud Connector is being rolled out gradually throughout 2024 to all customers. Once you have access, the Cloudflare dashboard will show a new **Cloud Connector** tab under **Rules** at the zone level. The maximum number of rules depends on your Cloudflare plan:
34+
35+
{{<feature-table id="rules.cloud_connector">}}

‎content/rules/cloud-connector/create-api.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
title: Configure via API
3+
pcx_content_type: how-to
4+
weight: 3
5+
meta:
6+
title: Configure a Cloud Connector rule via API
7+
---
8+
9+
# Configure a rule via API
10+
11+
You can configure Cloud Connector rules using the [Cloudflare API](/fundamentals/api/).
12+
13+
## Required permissions
14+
15+
The [API token](/fundamentals/api/get-started/create-token/) used in API requests to manage Cloud Connector rules must have at least the following permission:
16+
17+
- _Zone_ > _Cloud Connector_ > _Write_
18+
19+
{{<Aside type="note" header="Note">}}
20+
A token with this permission is only valid for the Cloud Connector endpoints described in this page. You cannot use it to interact with the `http_cloud_connector` phase via [Rulesets API](/ruleset-engine/rulesets-api/).
21+
{{</Aside>}}
22+
23+
## Endpoints
24+
25+
To obtain the complete endpoint, append the Cloud Connector endpoints listed below to the Cloudflare API base URL:
26+
27+
```txt
28+
https://api.cloudflare.com/client/v4
29+
```
30+
31+
The `{zone_id}` argument is the [zone ID](/fundamentals/setup/find-account-and-zone-ids/) (a hexadecimal string). You can find this value in the Cloudflare dashboard.
32+
33+
The following table summarizes the available operations.
34+
35+
Operation | Verb + Endpoint
36+
----------|----------------
37+
List Cloud Connector rules | `GET zones/{zone_id}/cloud_connector/rules`
38+
Create/update/delete Cloud Connector rules | `PUT /zones/{zone_id}/cloud_connector/rules`
39+
40+
## Example API calls
41+
42+
### List of Cloud Connector rules
43+
44+
The following example returns a list of existing Cloud Connector rules:
45+
46+
```bash
47+
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/cloud_connector/rules \
48+
--header "Authorization: Bearer <API_TOKEN>"
49+
```
50+
51+
```json
52+
---
53+
header: Example response
54+
---
55+
{
56+
"result": [
57+
{
58+
"id": "<RULE_1_ID>",
59+
"provider": "aws_s3",
60+
"expression": "http.request.uri.path wildcard \"/images/*\"",
61+
"description": "Connect to S3 bucket containing images",
62+
"enabled": true,
63+
"parameters": {
64+
"host": "examplebucketwithimages.s3.north-eu.amazonaws.com"
65+
}
66+
},
67+
{
68+
"id": "<RULE_2_ID>",
69+
"provider": "cloudflare_r2",
70+
"expression": "http.request.uri.path wildcard \"/videos/*\"",
71+
"description": "Connect to R2 bucket containing videos",
72+
"enabled": true,
73+
"parameters": {
74+
"host": "mybucketcustomdomain.example.com"
75+
}
76+
}
77+
],
78+
"success": true,
79+
"errors": [],
80+
"messages": []
81+
}
82+
```
83+
84+
### Create/update/delete Cloud Connector rules
85+
86+
The following example request will replace all existing Cloud Connector rules with a single rule:
87+
88+
```bash
89+
curl --request PUT \
90+
"https://api.cloudflare.com/client/v4/zones/{zone_id}/cloud_connector/rules" \
91+
--header "Authorization: Bearer <API_TOKEN>" \
92+
--header "Content-Type: application/json" \
93+
--data '[
94+
{
95+
"expression": "http.request.uri.path wildcard \"/images/*\"",
96+
"provider": "aws_s3",
97+
"description": "Connect to S3 bucket containing images",
98+
"parameters": {
99+
"host": "examplebucketwithimages.s3.north-eu.amazonaws.com"
100+
}
101+
}
102+
]'
103+
```
104+
105+
The required body parameters for each rule are: `expression`, `provider`, and `parameters.host`.
106+
107+
The `provider` value must be one of the following: `aws_s3`, `azure_storage`, `gcp_storage`, and `cloudflare_r2`.
108+
109+
{{<Aside type="warning" header="Warning">}}
110+
To create a new rule and keep all existing rules, you must include them all in your request body. Omitting an existing rule in the request body will delete the corresponding Cloud Connector rule.
111+
{{</Aside>}}

‎content/rules/cloud-connector/create-dashboard.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
title: Configure in the dashboard
3+
pcx_content_type: how-to
4+
weight: 2
5+
meta:
6+
title: Configure a Cloud Connector rule in the dashboard
7+
---
8+
9+
# Configure a rule in the dashboard
10+
11+
To configure a Cloud Connector rule in the dashboard:
12+
13+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and domain.
14+
15+
2. Go to **Rules** > **Cloud Connector**.
16+
17+
3. Select your [cloud provider](/rules/cloud-connector/providers/).
18+
19+
4. Enter the bucket URL and select **Next**.
20+
21+
{{<Aside type="warning">}}
22+
The bucket URL must follow a [specific format](/rules/cloud-connector/providers/) according to your provider.
23+
{{</Aside>}}
24+
25+
5. Enter a descriptive name for the rule in **Cloud Connector name**.
26+
27+
6. Under **If**, select **Custom filter expression** and [enter an expression](/ruleset-engine/rules-language/expressions/edit-expressions/) to define the traffic that will be redirected to the bucket. For example:
28+
29+
- To route all requests under `https://example.com/images/*` you could enter the following expression:<br/>
30+
`http.request.full_uri wildcard "https://example.com/images/*"`
31+
- To route all requests under `https://images.example.com/*` you could enter the following expression:<br/>
32+
`http.request.full_uri wildcard "https://images.example.com/*"`
33+
34+
Alternatively, select **All incoming requests** to redirect all incoming traffic for your zone to the storage bucket you selected.
35+
36+
To save and deploy your rule, select **Deploy**. If you are not ready to deploy the rule, select **Save as Draft**.

‎content/rules/cloud-connector/providers.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: Supported cloud providers
3+
pcx_content_type: reference
4+
weight: 10
5+
---
6+
7+
# Supported cloud providers
8+
9+
Cloud Connector currently supports the following cloud providers and services:
10+
11+
- Amazon Web Services - S3
12+
- Google Cloud Platform - Cloud Storage
13+
- Microsoft Azure - Blob Storage
14+
15+
{{<Aside type="note">}}
16+
Support for Cloudflare R2 will be added soon.
17+
{{</Aside>}}
18+
19+
## Amazon Web Services - S3 { #s3 }
20+
21+
The hostname of your S3 bucket URL must have one of the following formats (where `*` is a wildcard character):
22+
23+
- `*s3.amazonaws.com`
24+
- `*s3-website.<region>.amazonaws.com`
25+
- `*s3.<region>.amazonaws.com`
26+
- `*s3-website-<region>.amazonaws.com`
27+
28+
Cloud Connector supports both subdomain and URI path bucket URLs.
29+
30+
### Get the bucket URL
31+
32+
1. Go to the [Amazon S3 console](https://console.aws.amazon.com/s3/) and select **Buckets** in the navigation pane.
33+
2. Select the bucket name.
34+
3. Go to the **Properties** tab.
35+
4. Select the **Static Website Hosting** card. The **Endpoint** field shows your bucket URL.
36+
37+
For more information, refer to the [Amazon S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/EnableWebsiteHosting.html).
38+
39+
## Google Cloud Platform - Cloud Storage { #gcp }
40+
41+
The hostname of your Cloud Storage bucket URL must be the following:
42+
43+
- `*storage.googleapis.com`
44+
- `*storage.cloud.google.com`
45+
46+
Cloud Connector supports both subdomain and URI path bucket URLs.
47+
48+
### Get the bucket URL
49+
50+
1. Go to the [Google Cloud console](https://console.cloud.google.com/storage/browser) and select **Buckets**.
51+
2. Select the bucket name.
52+
3. For one of the files already in the bucket, select the link icon in the **Public** column to copy the file's public URL to the clipboard. The file URL will have the following format:
53+
54+
`https://storage.googleapis.com/<BUCKET_NAME>/<OBJECT_NAME>`
55+
56+
To obtain the bucket URL, remove `/<OBJECT_NAME>` from the file URL.
57+
58+
If the files in your bucket are not publicly accessible, you must change the bucket permissions. For details, refer to the [Google Cloud Storage documentation](https://cloud.google.com/storage/docs/access-control/making-data-public#buckets).
59+
60+
## Microsoft Azure - Blob Storage { #azure }
61+
62+
The hostname of your Blob Storage bucket URL must have one of the following formats (where `*` is a wildcard character):
63+
64+
- `*.blob.core.windows.net`
65+
- `*.web.core.windows.net`
66+
67+
### Get the bucket URL
68+
69+
1. Go to the [Azure portal](https://portal.azure.com/) and select your storage account.
70+
2. In the menu pane, under **Settings**, select **Endpoints**.
71+
3. Get your bucket URL from the **Blob service** endpoint or the **Static website** endpoint.
72+
73+
If the blob container is not configured for public access, you must change the container settings. For details, refer to the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure?tabs=portal).
74+
75+
76+

‎content/rules/compression-rules/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Compression Rules
33
pcx_content_type: concept
4-
weight: 8
4+
weight: 9
55
---
66

77
# Compression Rules

‎content/rules/configuration-rules/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
pcx_content_type: concept
33
title: Configuration Rules
4-
weight: 7
4+
weight: 2
55
meta:
66
title: Configuration Rules
77
---

‎content/rules/normalization/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
pcx_content_type: concept
33
title: URL normalization
4-
weight: 4
4+
weight: 11
55
---
66

77
# URL normalization

‎content/rules/page-rules/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: concept
33
source: https://support.cloudflare.com/hc/en-us/articles/218411427-What-do-the-custom-caching-options-mean-in-Page-Rules-#summary-of-page-rules-settings
44
title: Page Rules
5-
weight: 19
5+
weight: 10
66
---
77

88
# Page Rules

0 commit comments

Comments
 (0)