Cloudflare Access

cloudflare Bastion hostcloudflare-access

Zero Trust reverse proxy that authenticates and authorizes every request to an application.

Provider: cloudflare
Kind: Bastion host
Category: Security
Official docs: https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/

Properties · 4 set by this component

property	type	values	required	kind default	this component
applicationType · component property	enum	self-hosted \| saas \| private-network \| infrastructure \| rdp \| browser-ssh \| browser-vnc	no	self-hosted	inherited
justInTimeAccess	boolean	—	no	false	▸ false
managed	boolean	—	no	false	▸ true
mfaRequired	boolean	—	no	—	▸ false
protocols	enum	ssh \| rdp \| both	no	—	inherited
publicIp	boolean	—	no	—	inherited
sessionDurationHours · component property	integer	—	no	24	inherited
sessionRecording	boolean	—	no	—	▸ false

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "access", component: "cloudflare-access" }

Other Bastion host products · 17

Bastionhostalibaba-bastionhostalibabacloudbastion-host EC2 Instance Connect Endpointaws-ec2-instance-connect-endpointawsbastion-host AWS Systems Manager Session Manageraws-ssm-session-managerawsbastion-host AWS Verified Accessaws-verified-accessawsbastion-host Azure Bastionazure-bastionazurebastion-host Microsoft Entra Private Accessazure-entra-private-accessazurebastion-host Cloudflare One RDPcloudflare-rdpcloudflarebastion-host Generic bastion hostbastion-hostbastion-host HashiCorp Boundaryboundarybastion-host ContainerSSHcontainersshbastion-host Paralusparalusbastion-host Pomeriumpomeriumbastion-host OpenSSH jump hostssh-jump-hostbastion-host Teleportteleportbastion-host Chrome Enterprise Premiumgoogle-chrome-enterprise-premiumgcpbastion-host Identity-Aware Proxygoogle-identity-aware-proxygcpbastion-host Bastionoci-bastionocibastion-host

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Cloudflare Access: managed ZTNA reverse proxy that authenticates every request to an application.
3# "Session management" gives 24 hours as the default global and application session duration; MFA is
4# an opt-in policy requirement ("Enforce MFA"), so it is not a default.
5schemaVersion: "1"
6type: "component"
7id: "cloudflare-access"
8kind: "bastion-host"
9provider: "cloudflare"
10docs: "https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/"
11defaults:
12  managed: true
13  mfaRequired: false
14  sessionRecording: false
15  justInTimeAccess: false
16properties:
17  sessionDurationHours:
18    type: "integer"
19    default: 24
20  applicationType:
21    type: "enum"
22    values: ["self-hosted", "saas", "private-network", "infrastructure", "rdp", "browser-ssh", "browser-vnc"]
23    default: "self-hosted"

The same page as markdown, for an agent: /catalogue/components/cloudflare-access.md