Skip to content

Commit

Permalink
Update to generic recommendation
Browse files Browse the repository at this point in the history
  • Loading branch information
pedrosousa committed Oct 18, 2024
1 parent 95852ed commit 5058783
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 37 deletions.
44 changes: 7 additions & 37 deletions src/content/docs/rules/cloud-connector/providers.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ sidebar:
order: 4
---

import { Render } from "~/components";

Cloud Connector currently supports the following cloud providers and services:

- Amazon Web Services - S3
Expand Down Expand Up @@ -38,43 +40,7 @@ Cloud Connector supports both subdomain and URI path-style URLs:

For more information, refer to the [Amazon S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/EnableWebsiteHosting.html).

### Configure bucket policies to allow Cloudflare IP addresses

Now that you’ve created your buckets and enabled hosting for static content, you can set up permissions to allow Cloudflare to access your bucket.
This ensures that your site only responds to requests coming from the Cloudflare proxy. This is the [current list of IP address ranges](https://www.cloudflare.com/ips/) used by the Cloudflare proxy.

To set up your policy:

1. Follow these instructions from Amazon to [Add an S3 Bucket Policy](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/add-bucket-policy.html).
2. For the step where you enter the policy in the **Bucket policy editor**, use this sample to fill out the needed JSON code, making sure to replace:
- `www.example.com` (appearing in `"Resource": "arn:aws:s3:www.example.com/*"`) with the S3 bucket name for your subdomain URL.
- The placeholder IP addresses with the [current list of IP address ranges](https://www.cloudflare.com/ips/)

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudflareIPs",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::www.example.com/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"192.2.0.1/32" (example IPv4 address),
"192.2.1.0/24" (example IPv4 range),
"2001:db8::1111:1111" (example IPv6 address),
"2001:db8::/32" (example IPv6 range),
(add all IPs ranges at https://www.cloudflare.com/ips)
]
}
}
}
]
}
```
<Render file="cloud-connector-limit-bucket-to-cloudflare-ips" />

## Google Cloud Platform - Cloud Storage

Expand All @@ -101,6 +67,8 @@ Cloud Connector supports both subdomain and URI path-style URLs:

If the files in your bucket are not publicly accessible, you must change the bucket permissions. For details, refer to the [Google Cloud Storage documentation](https://cloud.google.com/storage/docs/access-control/making-data-public#buckets).

<Render file="cloud-connector-limit-bucket-to-cloudflare-ips" />

## Microsoft Azure - Blob Storage

The hostname of your Blob Storage bucket URL must have one of the following formats:
Expand All @@ -117,3 +85,5 @@ For Azure Blog Storage, Cloud Connector supports only subdomain URLs like `<BUCK
3. Get your bucket URL from the **Blob service** endpoint or the **Static website** endpoint.

If the blob container is not configured for public access, you must change the container settings. For details, refer to the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure?tabs=portal).

<Render file="cloud-connector-limit-bucket-to-cloudflare-ips" />
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
{}
---

Once you configure Cloud Connector with your storage provider's public bucket, you may wish that only Cloudflare can access the objects in that bucket. To achieve this, check your provider's documentation on how to create a policy that only allows incoming requests from [Cloudflare IP addresses](https://www.cloudflare.com/ips/).

0 comments on commit 5058783

Please sign in to comment.