Hi everyone! 👋 I’ve been following this community for a bit and have learned so much from all your posts. I’m relatively new to the whole zero trust/networking side of things (my background is more in the data analytics layer), but my team just finished a pretty big project and I wanted to share our journey.
We recently deployed Cloudflare One across five separate AWS accounts over a three-month period. Our main goal was to secure access to internal tools and data pipelines without having to manage a traditional VPN. As a data person, I was really excited about the potential for smoother, more secure connections to our databases and BI tools like Looker and Tableau.
Here’s a high-level walkthrough of how we approached it:
* **Phase 1 (Weeks 1-4):** We started with a single "pilot" AWS account. This was for a non-critical analytics environment. We set up Cloudflare Tunnel connectors (using the lightweight `cloudflared` daemon) on a few EC2 instances hosting internal applications. The biggest learning curve here was understanding the difference between public hostnames and private network routes in Zero Trust policies.
* **Phase 2 (Weeks 5-8):** After the pilot, we rolled out to two more AWS accounts that housed our core data warehouse and ETL processes (we use dbt and some custom pipelines). This phase involved a lot of policy creation—making sure only the right data engineering and analytics teams could access specific tools (like our dbt Cloud IDE) based on identity checks.
* **Phase 3 (Weeks 9-12):** The final push was to our last two accounts, which include some customer-facing applications. We integrated with our existing SSO (Okta) and set up more granular device posture checks.
For fellow beginners, I’d love some insights:
* What’s the best practice for organizing Tunnels and Routes across multiple cloud accounts? We ended up with a mix of one tunnel per account and a few shared ones, but I’m not sure if that’s optimal.
* How do you handle monitoring and logging for Cloudflare One in a way that’s actionable? We’re piping logs to S3, but I’d love recommendations on setting up dashboards to track connection events, especially for our self-serve analytics users.
The project was a success overall! Application access is much simpler for the team now. That said, the initial configuration of the Zero Trust rules felt a bit complex—I wish there were more template examples for common data stack tools (e.g., connecting to a Redshift cluster securely). If anyone has gone through a similar deployment, I'd really appreciate any tips or lessons you learned!
Starting with a pilot in a non-critical environment was so smart. That exact approach saved us when we rolled out a similar Zero Trust setup for our marketing analytics stack. We learned that even though the tech seems straightforward, user behavior is the real variable. Our analysts kept trying to reach old VPN bookmarks for weeks!
What was your team's biggest "gotcha" with the policies for the BI tools? We found setting up just-in-time access for Tableau to be trickier than expected.
Data-driven decisions.
Oh man, you hit the nail on the head about user behavior being the real variable. We had the same thing with our marketing team's old links to HubSpot dashboards - muscle memory is powerful!
Our biggest BI policy "gotcha" was with Looker, actually. The session timeout settings in Cloudflare's Access policies didn't play nicely with Looker's own embedded session logic at first. We had analysts getting logged out mid-analysis because the policies were fighting each other. The fix was tweaking the policy to allow longer session durations specifically for that app, which felt a bit counter to "zero trust" but was the only way to keep the workflow smooth.
Just-in-time for Tableau sounds like a headache. Did you end up using IdP groups or something more dynamic?
Marketing ops nerd
Starting with a pilot in a non-critical analytics account seems like the perfect way to learn. I'm currently evaluating similar tools and that's a big question for us: how do you measure the success of that pilot phase?
Beyond just checking if the tunnel connects, what metrics did you track to decide it was ready to roll out to the other four accounts? Was it purely uptime, or did you look at user experience or cost comparisons too?