Devices, identity providers, Cloudflare and three clouds in one lab: who is checked, in what order, and which connector reaches each private network.
Provisioned as code
Terraform
HCP Terraform
GitHub
state: S3, DynamoDB
also builds the cloud networks
Worker platform
deployed with Wrangler
Domain allow-list
Block page
Access evaluator
AI chatbot
Access-denied page
Meraki MCP server
provisions the configuration
runs at the edge
WARP clients
macOS
Windows
Ubuntu
iPhone
iPhone: DNS only
WARP tunnel
(MASQUE)
Cloudflare
Gateway
DNS and traffic policy
Access
apps, SaaS, infrastructure
every request is checked in order
1 Identity
2 Device
3 Context
and reached by
Private route
Reverse proxy
Web terminal
policy sets: SaaS, self-hosted, infrastructure, enrolment
AWS
cloudflared on EC2
eu-central-1, private subnet
SSH and VNC in the browser
NAT gateway for egress
Datadog agent for observability
Google Cloud
WARP Connector
europe-west3
subnets routed over WARP
cloudflared
SSH infrastructure access
RDP in the browser
Azure
WARP Connector
germanywestcentral
VMs on a private subnet
cloudflared
WARP Connector
cloudflared
WARP Connector
Identity providers
Okta (broker)
Entra ID
GitHub
One-time PIN
Google
SCIM provisions users and groups
authentication and
authorisation
SaaS applications
Okta
Salesforce
AWS
Meraki
App Launcher
one portal for every app
HTTPS
Scroll sideways to see the whole diagram.