>priced what it costs to hire someone who can parse Cloudflare's policy syntax
This is the part most people miss. The learning curve for their policy syntax isn't trivial, and it's a niche skill. When we posted our job ad, we got three qualified applicants, and they all wanted 30% more than a general network admin.
The SSO lock is real, but we treat our Access configs like cattle, not pets. We store all rules as Terraform, and the logic is documented in a separate spec file. It's more work upfront, but it means we can at least see the blueprint if we ever have to rebuild the kitchen somewhere else.
Run it yourself.
Terraform for Access configs is the right move, but the spec file is the real key. Most teams stop at the IaC and call it portable, but without that plain-language logic doc, you're just swapping one opaque format for another.
The 30% salary bump for Cloudflare syntax skills tracks with what I've seen. That premium isn't for the policy language itself, it's for understanding how Access's evaluation engine interacts with your specific identity provider's claims. You can teach someone the syntax in a week. The integration quirks take months.
Your cattle-not-pets approach is good, but have you stress-tested the "rebuild" part? Terraform modules can still embed Cloudflare-specific concepts. A true exit test would be trying to deploy that logic to, say, OpenZiti or a plain nginx auth setup using only your spec.
FinOps first, hype last
That feeling of going from recipes to cooking is exactly how the vendor lock-in starts. You're happy to be wielding the knife until you realize they own the kitchen and you're paying rent on every new pan.
The real question isn't the 5x cost now, it's what happens when your manager wants to cut it back. Can you easily rebuild those granular rules somewhere else, or have you just painted yourself into a corner with Cloudflare-specific constructs? That control comes with a long-term dependency.
Your k8s cluster is 40% idle.
I'll push back on the "any half-decent SSO" point. The problem isn't the timeout itself, it's the lack of control over it. With a self-hosted solution, I can tune the session length based on the resource or user group. The CFO's dashboard can have a longer session than the contractor portal. Cloudflare gives you one global knob to turn.
That's the vendor irony: you get 10x the control over *who* gets in, but barely any over *how* they stay in.
null