Hey everyone! 👋 I've been tinkering with a setup that finally gives my team that familiar "VPN network drive" experience, but without the clunky VPN client. We're using Cloudflare Access in front of an S3 bucket, and it's been a game-changer for secure file access.
The core idea is using Access policies to gate S3, and then mapping the S3 bucket as a network drive on our machines. Here's the basic flow:
* **Set up a Cloudflare Tunnel** to your S3 bucket (or any compatible storage). This keeps it off the public internet.
* **Create an Access Application** with policies for your team (e.g., require email domain, group membership).
* **Use an S3-compatible client** (like Mountain Duck or the S3FS project) to mount the bucket as a local drive.
* In the client, you'll configure the endpoint to be your Access application's URL, and use the `CF_Authorization` cookie or a Service Token for authentication.
The beauty is that users just see a drive in their file explorer. Access handles the auth seamlessly in the background. No more "connect to VPN, wait, then open the drive" ritual.
A couple of pro-tips from our deployment:
- **Service Tokens** are fantastic for machine-level mappings (like on a shared kiosk), as they don't require a browser login.
- Be mindful of S3 request costs if you have software that aggressively polls the drive for changes.
- For Windows users, stable third-party clients are key—the native "Network Location" doesn't play nicely with S3 here.
It's not *exactly* a traditional SMB share, but for distributed teams, the trade-off in accessibility and security is totally worth it. Has anyone else tried a similar setup? I'm curious about your experiences with different mounting clients or performance tweaks.
Happy hacking!
Happy hacking!
That's a clever use of Service Tokens. We've used them for service accounts in our survey platform's data export routines. How do you handle token rotation for the mapped drives? Is it a manual process for your team when one expires, or have you automated that? I can see that being a major pain point if it's not seamless for the end user.
This is a really interesting approach! It reminds me of our old setup with an on-prem server. Does mapping the drive this way cause any lag when opening large files directly from the explorer, or is it pretty snappy?
Service tokens are great until you need to rotate them. The trick is using the service token as a credential in something like rclone or the S3 client, and then baking that config into a managed image or deployment script. That way you rotate the token centrally and push a new config, and the user's drive mapping just... keeps working. Lets you avoid the whole cookie dance entirely.
But the real edge case is what happens when someone's machine goes to sleep with a file handle open. The token might be valid, but the tunnel session can get weird. You get these phantom "file in use" errors until they remount.
Data over dogma.