Repository navigation
[Data Localization Suite] Update Cloudflare One localization guidance #34346
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -116,16 +116,13 @@ The tables below show whether each Cloudflare product is compatible with each DL | |
|
|
||
| ## Zero Trust | ||
|
|
||
| Cloudflare One compatibility depends on the DLS control, traffic path, on-ramp, and dataset. The following table summarizes current support. Refer to [Data localization for Cloudflare One](/data-localization/how-to/zero-trust/) for supported regions, configuration, and product-specific behavior. | ||
|
Contributor
There was a problem hiding this comment. I appreciate the attempt to change the style of the content, but it's not great to end up with this state where some areas/products are kept in the old style, and others are in this new style. Should be all redone together IMO.
Collaborator
There was a problem hiding this comment. Agree we should revamp and improve the entire compatibility page. fyi @cferike |
||
|
|
||
| | DLS control | Current Cloudflare One coverage | | ||
| | - | - | | ||
| | **Geo Key Manager** | For an Access-protected application that uses a supported custom certificate, Geo Key Manager can restrict where Cloudflare stores the private TLS key for the protected application hostname. Refer to [Geo Key Manager](/data-localization/how-to/zero-trust/#geo-key-manager). | | ||
| | **Regional Services** | Gateway decrypts and inspects supported HTTPS traffic within the selected region when traffic is sent through the Cloudflare One Client in Traffic and DNS mode, Cloudflare Mesh, or Cloudflare WAN using IPsec. Access supports the FedRAMP Moderate Compliant (Domestic) region. Browser Isolation supports the US FedRAMP region. Separately, [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) uses its own region setting for Global or United States connections. Refer to [Regional Services for Gateway](/data-localization/how-to/zero-trust/#regional-services-for-gateway), [Access](/data-localization/how-to/zero-trust/#access), and [Browser Isolation](/data-localization/how-to/zero-trust/#browser-isolation). | | ||
|
Contributor
There was a problem hiding this comment. Some of my comments from the other page apply here as well |
||
| | **Customer Metadata Boundary** | CMB stores supported Customer Logs in the United States or European Union. Refer to [Customer Metadata Boundary for Cloudflare One](/data-localization/how-to/zero-trust/#customer-metadata-boundary). | | ||
|
|
||
| [^1]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. | ||
|
|
||
|
|
@@ -151,24 +148,6 @@ The tables below show whether each Cloudflare product is compatible with each DL | |
|
|
||
| [^13]: Logpush available with Customer Metadata Boundary for [these datasets](/data-localization/metadata-boundary/logpush-datasets/). Contact your account team if you need another dataset. | ||
|
|
||
| [^23]: Currently, customers do not have the ability to choose the location of the Cloudflare-managed R2 bucket for Log Explorer. | ||
|
|
||
| [^26]: You can use Static IP/BYOIP with Regionalized Spectrum Applications. You can also regionalize BYOIP prefixes at the IP layer with [Regionalized IP Bindings](/data-localization/regional-services/ip-bindings/). | ||
|
|
@@ -181,8 +160,6 @@ The tables below show whether each Cloudflare product is compatible with each DL | |
|
|
||
| [^30]: Regular/Generic and Custom Tiered Cache work with Customer Metadata Boundary (CMB). Smart Tiered Caching (where Cloudflare automatically selects intermediate cache data centers) does not work with CMB. <br/> With CMB set to EU, the Zone Dashboard **Caching** > **Tiered Cache** > **Smart Tiered Caching** option will not populate the Dashboard Analytics. | ||
|
|
||
| [^33]: If you use [outgoing zone transfers](/dns/zone-setups/zone-transfers/cloudflare-as-primary/) (where Cloudflare sends your DNS records to non-Cloudflare nameservers), those transfers will include global Cloudflare IP addresses rather than region-specific ones. This means Regional Services will not function correctly when end users receive DNS answers from non-Cloudflare nameservers. | ||
|
|
||
| [^34]: Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. | ||
|
|
@@ -215,6 +192,4 @@ The tables below show whether each Cloudflare product is compatible with each DL | |
|
|
||
| [^48]: The following are exceptions and are supported: AI Gateway Analytics (GraphQL Analytics datasets) and Logs (Logpush), R2 Dashboard Metrics & Analytics, Workers AI GraphQL Analytics datasets like aiInferenceAdaptive. | ||
|
|
||
| [^50]: Email and webhook notifications for DDoS and WAF events may not fire reliably when Customer Metadata Boundary is set to `eu`. This behavior is intermittent and under investigation. If timely alerts are critical, use [Logpush](/logs/logpush/) as a complementary monitoring mechanism. | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| --- | ||
| title: Zero Trust | ||
| pcx_content_type: how-to | ||
| description: Configure data localization controls for Cloudflare One traffic, private keys, and supported logs. | ||
| products: | ||
| - data-localization | ||
| - cloudflare-one | ||
|
|
@@ -12,78 +12,98 @@ sidebar: | |
| order: 1 | ||
| --- | ||
|
|
||
| Cloudflare One provides separate controls for where Cloudflare processes supported traffic and where Cloudflare stores supported logs. These controls have different settings and supported regions. | ||
|
Collaborator
There was a problem hiding this comment. Let's directly link and reference Cloudflare One or |
||
|
|
||
| | Control | What it controls | Current availability | | ||
| | - | - | - | | ||
| | [Regional Services for Gateway](#regional-services-for-gateway) | Where Gateway decrypts and inspects supported HTTPS traffic | Available for supported on-ramps and Cloudflare One regions | | ||
|
Collaborator
There was a problem hiding this comment. The regions are listed in the "Regional Services for Gateway" section; so we should probably explicitly link it also here, no? |
||
| | [Cloudflare Tunnel region](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) | Where `cloudflared` establishes its tunnel connections | Global or United States | | ||
| | [Customer Metadata Boundary (CMB)](#customer-metadata-boundary) | Where Cloudflare stores supported Customer Logs | European Union and United States | | ||
| | [Access with Regional Services](#access) | Where Cloudflare processes reverse proxy requests for Access-protected applications | FedRAMP Moderate Compliant (Domestic) only | | ||
| | [Browser Isolation for FedRAMP accounts](#browser-isolation) | Where Cloudflare processes supported Browser Isolation traffic | US FedRAMP region only | | ||
| | [Email Security regional processing](/cloudflare-one/email-security/reference/regional-processing/) | Where Email Security examines messages for supported deployment types | Refer to the Email Security documentation | | ||
|
Contributor
There was a problem hiding this comment.
This should have a link
Contributor
There was a problem hiding this comment. Why do we have Email Security here but, let's say, not CASB or DEX? |
||
|
|
||
| This guide describes the current scope of Cloudflare One data localization controls. | ||
|
Contributor
There was a problem hiding this comment. Having CF Tunnel mentioned above, but not the other connectors, feels odd. Maybe we can mention other connectors do not have the ability (yet?) to only terminate within region? |
||
|
|
||
| ## Regional Services for Gateway | ||
|
Collaborator
There was a problem hiding this comment. Can we re-add this part: Or did something change? |
||
|
|
||
| Regional Services controls where Cloudflare Gateway performs HTTP and Transport Layer Security (TLS) inspection. Gateway decrypts and inspects supported HTTPS traffic only within the selected region. | ||
|
Collaborator
There was a problem hiding this comment. We should specify that TLS decryption is required for Gateway HTTP/S inspection. Additionally, not sure if we want to be very clear here that "Regional Services for Gateway" only applies to Gateway HTTP, and NOT Network and DNS? |
||
|
|
||
| Regional Services for Gateway is configured at the Cloudflare One account level. The selected region applies to supported Gateway traffic for the account. Contact your account team to configure the region. | ||
|
|
||
| Cloudflare One supports this behavior for traffic sent to Gateway through these on-ramps: | ||
|
|
||
| - [Cloudflare One Client](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) in [Traffic and DNS mode](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#traffic-and-dns-mode-default) | ||
| - [Cloudflare Mesh](/cloudflare-one/networks/connectors/cloudflare-mesh/) | ||
| - [Cloudflare WAN](/cloudflare-one/networks/connectors/cloudflare-wan/) using IPsec | ||
|
Contributor
There was a problem hiding this comment.
it also works for GRE and CNI, it's independent The noteworthy aspect is that it requires Mark III (aka unified routing) |
||
|
|
||
| Connections from these on-ramps may terminate at a Cloudflare data center outside the selected region. For supported HTTPS traffic, Gateway forwards the still-encrypted HTTPS request to the selected region before TLS decryption and inspection. | ||
|
Contributor
There was a problem hiding this comment.
What would be "unsupported" HTTPS traffic?
Collaborator
There was a problem hiding this comment. +1 on the clarification for "unsupported" HTTPS traffic. And we should clarify better what "on-ramps may terminate at a Cloudflare data center outside the selected region" actually means; that this is separate to the content (HTTP payload) inspection in itself, so we forward the encrypted content to the in-region configured location, right? |
||
|
|
||
| Regional Services for Gateway is available in these regions: | ||
|
Collaborator
There was a problem hiding this comment. Include new managed Region |
||
|
|
||
| - European Union | ||
| - Exclusive of Hong Kong and Macau | ||
| - Exclusive of Russia and Belarus | ||
| - FedRAMP Moderate Compliant (Domestic) | ||
| - FedRAMP Moderate Compliant (International) | ||
| - IRAP Protected | ||
| - NATO | ||
| - United States of America | ||
|
|
||
| Refer to [Region support](/data-localization/region-support/) for region definitions. Contact your account team to inquire about the availability of other regions. | ||
|
Contributor
There was a problem hiding this comment.
I would bold that |
||
|
|
||
| ### Egress traffic | ||
|
Contributor
There was a problem hiding this comment. I am not understanding the point of this section in the context of regionalization. I feel like it's trying to tell me something, but it is not clear what.
Collaborator
There was a problem hiding this comment. Agreed. We should make it clearer that "Egress traffic" is a separate control and not related to the regionalization aspect, but still relevant to point out that customers have some form of configuration capability over Egress, so they don't confuse the two. |
||
|
|
||
| Regional Services controls where Gateway decrypts and inspects supported HTTPS traffic. Dedicated egress IPs provide predictable, account-specific source IP addresses. Customers can use them for origin allowlisting or to associate Gateway traffic with a selected IP geolocation. | ||
|
|
||
| Use [dedicated egress IPs](/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) and [Gateway egress policies](/cloudflare-one/traffic-controls/egress-policies/) to select these source IP addresses for Gateway traffic. | ||
|
|
||
| ## Access | ||
|
|
||
| Cloudflare Access uses two HTTPS connections: | ||
|
|
||
| 1. The user connects to the [Access team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name), such as `<team>.cloudflareaccess.com`, to authenticate. | ||
| 2. The user connects to the protected application hostname, such as `app.example.com`, to access the application. | ||
|
Collaborator
There was a problem hiding this comment. Do we want to specify that this applies only when it is a public hostname, right? |
||
|
|
||
| ### Regional Services | ||
|
|
||
| Regional Services controls where Cloudflare decrypts and processes supported HTTPS requests. Access supports Regional Services in the FedRAMP Moderate Compliant (Domestic) region. | ||
|
|
||
| Both Access connections require configuration: | ||
|
|
||
| 1. Contact your account team to configure the Access team domain. | ||
|
Contributor
There was a problem hiding this comment. configure ... as regionalized, right? otherwise it reads as if they need the account team to configure Access at all |
||
| 2. Assign the FedRAMP Moderate Compliant (Domestic) region to the protected application hostname using [Regional Services](/data-localization/regional-services/regional-hostnames/). | ||
|
Contributor
There was a problem hiding this comment. I think the app hostname could be any DLS region it's Point 1), i.e. the Access team domain, that is only FRM |
||
|
|
||
|
Collaborator
There was a problem hiding this comment. Do we want to add a "Verification" section in the Configuration Overview section? Similar to here: https://developers.cloudflare.com/data-localization/how-to/zero-trust/#verify-regional-map-application |
||
| When both are configured, Regional Services restricts supported reverse proxy request processing to FedRAMP-compliant data centers. For supported Access log storage, refer to [Customer Metadata Boundary](/data-localization/metadata-boundary/). | ||
|
|
||
| ### Geo Key Manager | ||
|
|
||
| If the protected application hostname uses a supported custom certificate, [configure Geo Key Manager](/ssl/edge-certificates/geokey-manager/setup/) to restrict where Cloudflare stores the private TLS key for that hostname. | ||
|
Collaborator
There was a problem hiding this comment. This section GKM is under "Access" only, but what about Gateway? We need a Gateway GKM section too. Before we said: |
||
|
|
||
| ## Browser Isolation | ||
|
|
||
| Browser Isolation supports Regional Services in the US FedRAMP region. Contact your account team to set up a FedRAMP account. | ||
|
|
||
| ## Customer Metadata Boundary | ||
|
|
||
| [Customer Metadata Boundary](/data-localization/metadata-boundary/) is an account-level setting that stores supported Customer Logs in the European Union or United States. It is configured independently from Regional Services. | ||
|
Collaborator
There was a problem hiding this comment. Customer Metadata Boundary (CMB) - let's add the acronym here. |
||
|
|
||
| Support varies by dataset. Refer to the current lists of [CMB-supported Logpush datasets](/data-localization/metadata-boundary/logpush-datasets/) and [CMB-supported GraphQL datasets](/data-localization/metadata-boundary/graphql-datasets/). | ||
|
|
||
| Some Cloudflare One dashboards and APIs cannot retrieve data stored with EU CMB. For supported datasets, use [Logpush](/logs/logpush/) to send a copy of the logs to a destination you control. | ||
|
Contributor
There was a problem hiding this comment. This doesn't look great, but I'm afraid we can't do better than just saying "some won't work", right? Also, this is making it unclear whether logpush happens in-region or out of region |
||
|
|
||
| ## Additional log controls | ||
|
|
||
| Some Cloudflare One products provide additional product-specific controls for reducing or protecting logged data. | ||
|
|
||
| ### Gateway logs | ||
|
|
||
| Use Gateway logging controls to [exclude supported personally identifiable information fields](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/manage-pii/) or [select which events appear in Cloudflare One activity logs](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#selective-logging). | ||
|
|
||
| ### DLP payload and AI prompt logging | ||
|
Collaborator
There was a problem hiding this comment. I believe we should re-add this part: Or did something change? Plus that AI Prompt profiles uses Workers AI in the background, which are not regionalized today, correct? |
||
|
|
||
| [Configure DLP payload and AI prompt logging](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/) to encrypt matched content with a customer-provided public key. Only the customer holds the private key required to decrypt the protected content. | ||
|
Collaborator
There was a problem hiding this comment. Do we want to also clarify that DLP can only be used as part of Gateway HTTP Policies? Plus, what is the situation now with Workers integration? https://blog.cloudflare.com/programmable-gateway-dlp/ |
||
|
|
||
| ### SSH command logs | ||
|
|
||
| [SSH command logs](/cloudflare-one/insights/logs/dashboard-logs/ssh-command-logs/) can encrypt downloadable logs with a customer-provided public key for local decryption. This encryption only applies to downloadable SSH logs, not to logs exported through Logpush. | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The other page keeps saying Cloudflare One, and even below we say it, so this saying Zero Trust is confusing?
Although the Dashboard is actually saying Zero Trust and no longer Cloudflare One, so I'm confused
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Agreed – personally, I'd prefer if we renamed it to product name: Cloudflare One.
However, I have customer's who are confused about product names and prefer industry-terms like "Zero Trust". So we should mention it in the description or something; could also be helpful for SEO/AEO.