Cloudflare Docs
Cloudflare Zero Trust
Cloudflare Docs
Cloudflare Zero Trust
Edit this page
Report an issue with this page
Log into the Cloudflare dashboard
Set theme to dark (⇧+D)
  1. Products
  2. Cloudflare Zero Trust
  3. ...
  4. ...
  5. ...
  6. Environments
  7. AWS

Deploy cloudflared in AWS

This guide covers how to connect an Amazon Web Services (AWS) virtual machine to Cloudflare using our lightweight connector, cloudflared.

We will deploy:

  • An EC2 virtual machine that runs a basic HTTP server.
  • A Cloudflare Tunnel that allows users to connect to the service via either a public hostname or a private IP address.

​​ Prerequisites

To complete the following procedure, you will need to:

​​ 1. Create a VM instance in AWS

  1. From the AWS console, go to Compute > EC2 > Instances

  2. Select Launch instance.

  3. Name your VM instance. In this example we will name it http-test-server.

  4. For *Amazon Machine Image (AMI) choose your desired operating system and specifications. For this example, we will use Ubuntu Server 24.04 LTS (HVM), SSD Volume Type.

  5. For Instance type:, you can select t2.micro which is available on the free tier.

  6. In Key pair (login), create a new key pair to use for SSH. You will need to download the .pem file onto your local machine.

  7. In Network settings, select Create security group.

  8. Turn on the following Security Group rules:

    • Allow SSH traffic from My IP to prevent the instance from being publicly accessible.
    • Allow HTTPS traffic from the internet
    • Allow HTTP traffic from the internet

  9. Select Launch instance.

  10. Once the instance is up and running, go to the Instances summary page and copy its Public IPv4 DNS hostname (for example, ec2-44-202-59-16.compute-1.amazonaws.com).

  11. To log in to the instance over SSH, open a terminal and run the following commands:

$ cd Downloads

chmod 400 "YourKeyPair.pem"
$ ssh -i "YourKeyPair.pem" ubuntu@ec2-44-202-59-16.compute-1.amazonaws.com

  1. Run sudo su to gain full admin rights to the instance.

  2. For testing purposes, you can deploy a basic Apache web server on port 80:

$ apt update


$ apt -y install apache2


$ cat <<EOF > /var/www/html/index.html
<html><body><h1>Hello Cloudflare!</h1>
<p>This page was created for a Cloudflare demo.</p>
</body></html>
EOF
  1. To verify that the Apache server is running, open a browser and go to http://ec2-44-202-59-16.compute-1.amazonaws.com (make sure to connect over http, not https). You should see the Hello Cloudflare! test page.

​​ 2. Create a Cloudflare Tunnel

Next, we will create a Cloudflare Tunnel in Zero Trust and run the tunnel on the AWS instance.

  1. Log in to Zero Trust and go to Networks > Tunnels.

  2. Select Create a tunnel.

  3. Choose Cloudflared for the connector type and select Next.

  4. Enter a name for your tunnel (for example, aws-tunnel).

  5. Select Save tunnel.

  6. Under Choose your environment, select Debian. Copy the command shown in the dashboard and run it on your AWS instance.

  7. Once the command has finished running, your connector will appear in Zero Trust.

  8. Select Next.

​​ 3. Connect using a public hostname

Public hostname routes allow anyone on the Internet to connect to HTTP resources hosted on your virtual private cloud (VPC). To add a public hostname route for your Cloudflare Tunnel:

  1. In the Public Hostname tab, enter a hostname for the application (for example, hellocloudflare.<your-domain>.com).
  2. Under Service, enter http://localhost:80.
  3. Select Save hostname.
  4. To test, open a browser and go to http://hellocloudflare.<your-domain>.com. You should see the Hello Cloudflare! test page.

You can optionally create an Access application to control who can access the service.

​​ 4. Connect using a private IP

Private network routes allow users to connect to your virtual private cloud (VPC) using the WARP client. To add a private network route for your Cloudflare Tunnel:

  1. In the Private Network tab, enter the Private IPv4 address of your AWS instance (for example, 172.31.19.0). You can expand the IP range later if necessary.

  2. In your Split Tunnel configuration, make sure the private IP is routing through WARP. For example, if you are using Split Tunnels in Exclude mode, delete 172.16.0.0/12. We recommend re-adding the IPs that are not explicitly used by your AWS instance – you can use this calculator to determine which IP addresses to re-add.

  3. To test on a user device:

    1. Log in to the WARP client.
    2. Open a terminal window and connect to the service using its private IP:
    $ curl 172.31.19.0

    <html><body><h1>Hello Cloudflare!</h1>
    <p>This page was created for a Cloudflare demo.</p>
    </body></html>

You can optionally create Gateway network policies to control who can access the instance via its private IP.

​​ Firewall configuration

To secure your AWS instance, you can configure your Security Group rules to deny all inbound traffic and allow only outbound traffic to the Cloudflare Tunnel IP addresses. All Security Group rules are Allow rules; traffic that does not match a rule is blocked. Therefore, you can delete all inbound rules and leave only the relevant outbound rules.

After configuring your Security Group rules, verify that you can still access the service through Cloudflare Tunnel via its public hostname or private IP. The service should no longer be accessible from outside Cloudflare Tunnel – for example, if you go to http://ec2-44-202-59-16.compute-1.amazonaws.com the test page should no longer load.