Cloudflare
Purpose
Collects accounts, zones, DNS records, account members and roles, R2 buckets, Worker scripts and routes, and account- and zone-level rulesets from Cloudflare.
Credential
The recommended credential is the Cloudflare OAuth integration: install it from
Settings > Integrations and leave cloudflare_token empty. SubImage then
holds a short-lived token it refreshes for you. See the
Cloudflare integration guide.
Use an API token instead when your account administrator has turned off public OAuth application access, or when you want the credential held in your own AWS Secrets Manager.
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Fields
| Field | Secret? | Description |
|---|---|---|
cloudflare_token |
Yes | Cloudflare API token with the read scopes below. Leave empty to use the OAuth integration. |
Token Scopes
| Scope | Used for |
|---|---|
Account Settings:Read |
Accounts |
Account Membership:Read |
Members and roles |
Zone:Read |
Zones |
Zone DNS:Read |
DNS records |
Workers R2 Storage:Read |
R2 buckets and their custom domains |
Workers Scripts:Read |
Worker scripts |
Workers Routes:Read |
Worker routes |
Account Rulesets:Read |
Account-level rulesets and rules |
Zone WAF:Read |
Zone-level rulesets and rules |
The Read all resources template covers all of them.
Setup Steps
- In the Cloudflare dashboard, go to My Profile → API Tokens → Create Token and start from the Read all resources template, or grant the individual scopes listed above.
- Copy the token value; it is shown only once.
- In SubImage, enter the token in
cloudflare_token(or its AWS Secret ARN) and save the module.
To move to OAuth later, install the integration and clear cloudflare_token.
The sync automatically enumerates every zone accessible to the token.
Notes
- R2 degrades instead of failing the run. If the bucket listing is refused, R2 is skipped with a warning, the Workers and ruleset stages still run, and buckets from earlier runs are kept rather than deleted. If only the per-bucket domain lookups are refused, buckets are ingested with their internet exposure left unresolved.
- R2 buckets are listed once per jurisdiction (
default,eu,fedramp). Theeuandfedrampjurisdictions are granted on request, so an account without the grant is treated as holding no bucket there.