Add an infrastructure application

Feature availability

WARP modes	Zero Trust plans ↗
Gateway with WARP Secure Web Gateway without DNS filtering	All plans

System	Availability
Windows	✅
macOS	✅
Linux	✅
iOS	✅
Android	✅
ChromeOS	✅

Access for Infrastructure allows you to have granular control over how users access individual servers, clusters, or databases in your private network. By adding an infrastructure application to Cloudflare Access, you can configure how users authenticate to the resource as well as control and authorize the ports, protocols, and usernames that they can connect with. Access and command logs ensure regulatory compliance and allow for auditing of user activity in case of a security breach.

Note

Access for Infrastructure currently only supports SSH.

Prerequisites

• Connect your private network to Cloudflare using cloudflared or WARP Connector.
• Deploy the WARP client on user devices in Gateway with WARP mode.

1. Add a target

A target represents a single resource in your infrastructure (such as a server, Kubernetes cluster, database, or container) that users will connect to through Cloudflare. Targets are protocol-agnostic, meaning that you do not need to define a new target for each protocol that runs on the server.

To create a new target:

Dashboard

1. In Zero Trust ↗, go to Networks > Targets.
2. Select Add a target.
3. In Target hostname, enter a user-friendly name for the target resource. We recommend using the server hostname, for example production-server. The hostname does not need to be unique and can be reused for multiple targets. Hostnames are used to define the subset of targets included in an infrastructure application and are not used in DNS address resolution.

   Format restrictions

   • Case insensitive
   • Contain no more than 253 characters
   • Contain only alphanumeric characters, -, or . (no spaces allowed)
   • Start and end with an alphanumeric character
4. In IP addresses, enter the private IPv4 and/or IPv6 address of the target resource. If the IP address overlaps across multiple private networks, select the virtual network where the resource is located. This IP address and virtual network pairing is now assigned to this target and cannot be reused in another target by design.

IP address requirements

• Public IPs are not currently supported.
• The IP address must be reachable through Cloudflare Tunnel.
• You must input the full IP address. The selector in the UI does not do partial matches.

5. Select Add target.

API

1. Create an API token with the following permissions:

   Type	Item	Permission
   Account	Zero Trust	Edit

2. Make a POST request to the Infrastructure Access Targets endpoint:

   curl https://api.cloudflare.com/client/v4/accounts/{account_id}/infrastructure/targets \
   --header "Authorization: Bearer <API_TOKEN>" \
   --data '{
     "hostname": "infra-access-target",
     "ip": {
       "ipv4": {
         "ip_addr": "187.26.29.249",
         "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
       },
       "ipv6": {
         "ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
         "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
       }
     }
   }'

Terraform

1. Add the following permission to your cloudflare_api_token ↗:

   • Teams Write

2. Configure the cloudflare_zero_trust_infrastructure_access_target ↗ resource:

   resource "cloudflare_zero_trust_infrastructure_access_target" "infra-ssh-target" {
     account_id = var.cloudflare_account_id
       hostname   = "infra-access-target"
       ip = {
         ipv4 = {
           ip_addr = "187.26.29.249"
           virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
         }
         ipv6 = {
           ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
           virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
         }
       }
   }

Next, create an infrastructure application to secure the target.

2. Add an infrastructure application

Dashboard

1. In Zero Trust ↗, go to Access > Applications.
2. Select Add an application.
3. Select Infrastructure.
4. Enter any name for the application.
5. In Target criteria, select the target hostname(s) that will represent the application. The application definition will apply to all targets that share the selected hostname, including any targets added in the future.
6. Enter the Protocol and Port that will be used to connect to the server.
7. (Optional) If a protocol runs on more than one port, select Add new target criteria and reconfigure the same target hostname and protocol with a different port number.

   Note

   Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol.

8. Select Next.
9. To secure your targets, configure a policy that defines who can connect and how they can connect:
   1. Enter any name for your policy.
   2. Create a rule that matches the users who are allowed to reach the targets. For more information, refer to Access policies and review the list of infrastructure policy selectors.
   3. In Connection context, enter the UNIX usernames that users can log in as (for example, root or ec2-user).
10. Select Add application.

API

1. Create an API token with the following permissions:

   Type	Item	Permission
   Account	Access: Apps & Policies	Edit

2. Make a POST request to the Access applications endpoint:

   curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \
   --header "Authorization: Bearer <API_TOKEN>" \
   --header "Content-Type: application/json" \
   --data '{
     "name": "Example infrastructure app",
     "type": "infrastructure",
     "target_criteria": [
       {
         "target_attributes": {
           "hostname": [
             "infra-access-target"
           ]
         },
         "port": 22,
         "protocol": "SSH"
       }
     ],
     "policies": [
       {
         "name": "Allow a specific email",
         "decision": "allow",
         "include": [
           {
             "email": {
               "email": "jdoe@company.com"
             }
           }
         ],
         "connection_rules": {
           "ssh": {
             "usernames": [
               "root",
               "ec2-user"
             ]
           }
         }
       }
     ]
   }'

Terraform

1. Add the following permission to your cloudflare_api_token ↗:

   • Access: Apps and Policies Write

2. Use the cloudflare_zero_trust_access_application ↗ resource to create an infrastructure application:

   resource "cloudflare_zero_trust_access_application" "infra-app" {
     account_id = var.cloudflare_account_id
     name       = "Example infrastructure app"
     type       = "infrastructure"
   
     target_criteria {
       port     = 22
       protocol = "SSH"
       target_attributes {
         name = "hostname"
         values = ["infra-access-target"]
       }
     }
   }

3. Use the cloudflare_zero_trust_access_policy ↗ resource to add an infrastructure policy to the application:

   resource "cloudflare_zero_trust_access_policy" "infra-app-policy" {
     application_id = cloudflare_zero_trust_access_application.infra-app.id
     account_id = var.cloudflare_account_id
     name       = "Allow a specific email"
     decision   = "allow"
     precedence = 1
   
     include {
       email = ["jdoe@company.com"]
     }
   
     connection_rules {
       ssh {
         usernames = ["root", "ec2-user"]
       }
     }
   }

The targets in this application are now secured by your infrastructure policies.

Note

Gateway network policies take precedence over infrastructure policies. For example, if you block port 22 for all users in Gateway, then no one can SSH over port 22 to your targets.

3. Configure the server

Certain protocols require configuring the server to trust connections through Access for Infrastructure. For more information, refer to the protocol-specific tutorial:

• SSH

4. Connect as a user

Users connect to the target’s IP address as if they were on your private network, using their preferred client software. The user must be logged into WARP on their device, but no other system configuration is required. You can optionally configure a private DNS resolver to allow connections to the target’s private hostname.

Connect to different VNET

To connect to targets that are in different VNETS, users will need to switch their connected virtual network in the WARP client.

Note

If a user is connected to a target in VNET-A and needs to connect to a target in VNET-B, switching their VNET will not break any existing connections to targets within VNET-A. At present, connections are maintained between VNETs.

Display available targets

Feature availability

System	Availability	Minimum WARP version
Windows	✅	2024.9.346.0
macOS	✅	2024.9.346.0
Linux	✅	2024.9.346.0
iOS	❌
Android	❌
ChromeOS	❌

Users can use warp-cli to display a list of targets they can access. On the WARP device, open a terminal and run the following command:

warp-cli target list

╭──────────────────────────────────────┬──────────┬──────┬────────────────────────────────┬───────────────────────────────────────────────────┬───────────╮
│ Target ID                            │ Protocol │ Port │ Attributes                     │ IP (Virtual Network)                              │ Usernames │
├──────────────────────────────────────┼──────────┼──────┼────────────────────────────────┼───────────────────────────────────────────────────┼───────────┤
│ 0192027a-ef8a-7966-aff6-4576475db365 │ SSH      │ 22   │ hostname: digital-ocean-target │ 10.116.0.3 (a663a21c-76e5-4e3c-8296-d856682269f9) │ root      │
├──────────────────────────────────────┼──────────┼──────┼────────────────────────────────┼───────────────────────────────────────────────────┼───────────┤
│ 0192027a-ef8a-7966-aff6-4576475db365 │ SSH      │ 23   │ hostname: digital-ocean-target │ 10.116.0.3 (a663a21c-76e5-4e3c-8296-d856682269f9) │ root      │
╰──────────────────────────────────────┴──────────┴──────┴────────────────────────────────┴───────────────────────────────────────────────────┴───────────╯

Revoke a user’s session

To revoke a user’s access to all infrastructure targets, you can either revoke the user from Zero Trust or revoke their device. Cloudflare does not currently support revoking a user’s session for a specific target.

Infrastructure policy selectors

The following Access policy selectors are available for securing infrastructure applications:

• Email
• Emails ending in
• SAML group
• Country
• Authentication method
• Device posture
• Entra group, GitHub organization, Google Workspace group, Okta group