Cloudflare Tunnel

A secure, outbound-only connection from a private network to Cloudflare's edge, exposing private services via public hostnames and/or WARP-reachable private routes.

What Gets Created

  • A cloudflare_zero_trust_tunnel_cloudflared.
  • When configSrc is cloudflare and ingress is set, a cloudflare_zero_trust_tunnel_cloudflared_config (provisioned separately so editing ingress never recreates the tunnel).
  • The connector run token is read via the tunnel token data source and exported.

Prerequisites

  • A Cloudflare account ID.
  • A connector (cloudflared) to run with the exported token.
  • For public hostnames, a DNS record CNAME'd to the tunnel CNAME target.

Configuration Reference

Required

  • accountId — Cloudflare account ID.
  • name — tunnel name.

Optional

  • configSrc (cloudflare | local), tunnelSecret (sensitive).
  • ingress[] (hostname, service, path, originRequest) — the last must be a catch-all.
  • originRequest.* — origin connection settings, including Access enforcement.

Stack Outputs

OutputDescription
tunnel_idThe tunnel UUID
tunnel_cnameCNAME target for public hostnames
tunnel_tokenConnector run token (sensitive)
tunnel_statusTunnel status
account_tagAccount tag
created_onCreation timestamp

Related Components

  • CloudflareZeroTrustTunnelRoute
  • CloudflareZeroTrustTunnelVirtualNetwork
  • CloudflareZeroTrustAccessApplication
  • CloudflareDnsRecord

Next article

Cloudflare Tunnel Route

Cloudflare Tunnel Route Advertise a private CIDR as reachable through a Cloudflare Tunnel, within a virtual network. What Gets Created A cloudflarezerotrusttunnelcloudflaredroute. Prerequisites A Cloudflare account ID. A tunnel (CloudflareZeroTrustTunnel) to serve the network. Optionally, a virtual network (CloudflareZeroTrustTunnelVirtualNetwork) to isolate overlapping CIDRs. Configuration Reference Required accountId — Cloudflare account ID. network — private CIDR to advertise. tunnelId —...
Read next article