← Rules / rules / cloud-connector

Supported cloud providers in Cloud Connector

Cloud Connector currently supports the following cloud providers and services:

• Cloudflare R2
• Amazon Web Services - S3
• Google Cloud Platform - Cloud Storage
• Microsoft Azure - Blob Storage
• Oracle Cloud - Object Storage

The Cloudflare R2 bucket must be public and exposed using a custom domain. Buckets exposed using an r2.dev subdomain are not supported.

Additionally, the custom domain must be defined in the same zone where you are configuring the Cloud Connector rule.

The hostname of your S3 bucket URL must have one of the following formats (where * is a wildcard character):

• *s3.amazonaws.com
• *s3.<REGION>.amazonaws.com
• *s3-website.<REGION>.amazonaws.com
• *s3-website-<REGION>.amazonaws.com

Cloud Connector supports both subdomain and URI path-style URLs:

• Subdomain-style URLs: Set the hostname to <BUCKET_NAME>.s3.amazonaws.com. In this case, your files are accessible directly under the root of the bucket. For example, https://example.com/index.html will map to https://<BUCKET_NAME>.s3.amazonaws.com/index.html. When using Full (Strict) SSL/TLS mode, the <BUCKET_NAME> cannot include dots (use dashes instead). Refer to SSL connections to AWS S3 endpoints for details.
• URI path-style URLs: Set the hostname to s3.amazonaws.com. Here, your bucket name must be part of the URI path in your requests. For example, if your bucket name is <BUCKET_NAME>, files will be available on paths like https://example.com/<BUCKET_NAME>/index.html, and your Cloud Connector rule should filter traffic based on the URI path starting with /<BUCKET_NAME>.

The SSL setting applied to requests between Cloud Connector and AWS S3 depends on the type of S3 endpoint you use:

• HTTPS-supported endpoints: For hostnames like *s3.<REGION>.amazonaws.com and *s3.amazonaws.com, Cloudflare will connect to AWS S3 over HTTPS if you set your zone's SSL/TLS mode to Full or Full (Strict). When using Full (Strict), the bucket name cannot include dots (use dashes instead).
• Non-HTTPS endpoints: For website-style hostnames such as *s3-website.<REGION>.amazonaws.com or *s3-website-<REGION>.amazonaws.com, which do not support HTTPS, Cloudflare will default to Flexible SSL.

For more information, refer to the Amazon S3 documentation ↗.

Once you configure Cloud Connector with your storage provider's public bucket, you may wish that only Cloudflare can access the objects in that bucket. To achieve this, check your provider's documentation on how to create a policy that only allows incoming requests from Cloudflare IP addresses ↗.

The hostname of your Cloud Storage bucket URL must be the following (where * is a wildcard character):

• *storage.googleapis.com
• *storage.cloud.google.com

Cloud Connector supports both subdomain and URI path-style URLs:

• Subdomain-style URLs: Set the hostname to <BUCKET_NAME>.storage.googleapis.com. In this case, your files are accessible directly under the root of the bucket. For example, https://example.com/index.html will map to https://<BUCKET_NAME>.storage.googleapis.com/index.html.
• URI path-style URLs: Set the hostname to storage.googleapis.com. Here, your bucket name must be part of the URI path in your requests. For example, if your bucket name is <BUCKET_NAME>, files will be available on paths like https://example.com/<BUCKET_NAME>/index.html, and your Cloud Connector rule should filter traffic based on the URI path starting with /<BUCKET_NAME>.

If the files in your bucket are not publicly accessible, you must change the bucket permissions. For details, refer to the Google Cloud Storage documentation ↗.

Once you configure Cloud Connector with your storage provider's public bucket, you may wish that only Cloudflare can access the objects in that bucket. To achieve this, check your provider's documentation on how to create a policy that only allows incoming requests from Cloudflare IP addresses ↗.

The hostname of your Blob Storage bucket URL must have one of the following formats:

• <BUCKET_NAME>.blob.core.windows.net
• <BUCKET_NAME>.web.core.windows.net

For Azure Blog Storage, Cloud Connector supports only subdomain URLs like <BUCKET_NAME>.blob.core.windows.net. This means that your files will be accessible directly under the root of the bucket. For example, https://example.com/index.html will map to https://<BUCKET_NAME>.blob.core.windows.net/index.html.

If the blob container is not configured for public access, you must change the container settings. For details, refer to the Azure Storage documentation ↗.

Once you configure Cloud Connector with your storage provider's public bucket, you may wish that only Cloudflare can access the objects in that bucket. To achieve this, check your provider's documentation on how to create a policy that only allows incoming requests from Cloudflare IP addresses ↗.

Cloud Connector supports Oracle Cloud Infrastructure (OCI) Object Storage through the Amazon S3 Compatibility API.

Enter an OCI hostname without a protocol, port, or path. Cloud Connector accepts the following formats:

For path-style endpoints, include the bucket name in the incoming request path. For example, https://example.com/<BUCKET_NAME>/index.html maps to the same path on the OCI endpoint.

For virtual-hosted endpoints, the bucket name is part of the hostname. An incoming request to https://example.com/index.html maps to /index.html on that bucket. OCI requires virtual-hosted bucket names to use a regional scope and a DNS-compatible name that is unique within the region.

For more information, refer to Object Storage Dedicated Endpoints ↗, Amazon S3 Compatibility API Hosted Style Support in Object Storage ↗, and Changing an Object Storage Bucket's Visibility ↗.

Once you configure Cloud Connector with your storage provider's public bucket, you may wish that only Cloudflare can access the objects in that bucket. To achieve this, check your provider's documentation on how to create a policy that only allows incoming requests from Cloudflare IP addresses ↗.