Cloudflare introduces new granular access controls and roles for Workers

Granular Access for Cloudflare Workers

Cloudflare has rolled out new access controls for its Developer Platform, specifically targeting Cloudflare Workers. This update enables users to grant access to individual Workers, rather than providing broad account-level permissions. The change addresses the need for more precise control over who can modify applications, particularly for teams and automated agents.

Introduction of Four New Roles

The update introduces four new roles designed to limit what a user or agent can do within a Worker. These roles aim to balance the need for specific permissions without creating an overly complex system. The roles allow for actions ranging from debugging without exposing source code, reading content without modification, making changes without deletion, to full management of a Worker.

Flexible Scoping Options

These new roles can be applied at three different scopes: the Developer Platform level, the product level (e.g., all Workers), or the resource level (e.g., a single Worker). This flexibility ensures that access can be tailored precisely to the requirements of a specific task or user, supporting the principle of least privilege. For example, a 'metadata read-only' control can be set at any of these levels.

API Token Integration

The new access controls are available for all customers immediately. Users can assign these roles directly to teammates logging into the dashboard, ensuring they only see Workers they have access to. Additionally, API tokens can be created with scoped access, allowing automated agents to interact with specific applications without broader permissions.

Future Expansion to Other Products

Cloudflare plans to extend these resource-level access controls to other products within its Developer Platform. This includes services such as D1, R2, and KV, indicating a broader strategy to implement consistent and granular access management across its offerings.