Cloudflare adds a policy gate for cloud API requests
Cloud Workload Security, now in beta, lets you write Rego rules that block risky cloud API calls, such as making an R2 bucket public, before they reach the provider.
Cloudflare launched Cloud Workload Security (CWS) in beta on 19 October, a Zero Trust feature that applies policy controls to cloud API requests before they reach the provider.
You define policies as request filters and Rego checks, then route client requests through a CWS proxy running in your own environment. Cloudflare’s own example is blocking any request that would make an R2 bucket public while still allowing ones that keep it private. Workloads and policy sets let you scope rules to specific cloud environments, managed from the Cloudflare dashboard. CWS requires a Zero Trust subscription, and the free Zero Trust plan is enough to try it.
Why it matters: this is a guardrail against the kind of misconfiguration that causes most cloud breaches, a storage bucket or IAM change going out with nobody checking it first. Writing the check as a policy that runs before the API call lands, rather than scanning for it afterwards, catches the mistake before it’s live instead of after.
The caveat: it’s a beta, and Cloudflare’s own documentation only details AWS and Cloudflare’s own API as targets so far. Check whether your cloud provider is covered before building a workflow around it.