The decisions it encodes
- The order of the checks is the design. Identity comes first, then the state of the device, then the context of the request, and only the last step grants anything. Each step can refuse on its own, so a valid sign-in on an unknown device still goes nowhere.
- One broker in front of the identity providers. Okta sits between Cloudflare and the other sources of identity, so Access sees one provider however a person actually signs in, and provisioning reaches users and groups through SCIM.
- Two connector types, used where they fit. AWS is reached with
cloudflared, Azure with a WARP Connector, and Google Cloud has both side by side. The WARP Connector tunnel is labelled beta in the source drawing. - Everything is code. Terraform builds the Cloudflare configuration and the three cloud networks, and the Workers (a block page, an access-denied page, a domain allow-list and an AI chatbot among them) are deployed with Wrangler.
Where it comes from
This is a simplified redraw of the architecture diagram for the multi-cloud Zero Trust lab. The original is a much denser drawing, with each cloud’s subnets, route tables and hostnames in it. Names, hostnames and policy lists are left out here on purpose, and the original’s policy sets are reduced to a single line.