Overview
Cloud Connectivity is the layer that carries traffic between the two providers Adventive runs on. Cloudflare Workers execute at the edge and reach the databases in AWS, but AWS holds those databases on a private network with no public endpoint. Cloudflare has no native PrivateLink path into a customer VPC, so the connection is built with Cloudflare Tunnel: a cloudflared daemon runs on EC2 inside the target VPC and opens an outbound-only session to Cloudflare’s edge. Hyperdrive routes its pooled database connections through that tunnel to the private Aurora endpoints.
This section is the operating standard for that tunnel. It spans both providers by design, so it lives on its own rather than inside the Cloudflare or AWS provider pages: the Cloudflare tunnel resources, the AWS EC2 fleet that runs the daemon, the Secrets Manager wiring, and the New Relic health layer are documented here as one system.
Where the tunnel sits
Section titled “Where the tunnel sits”The daemon dials out to Cloudflare (7844, with 443 as fallback). No inbound security-group rule is required on the AWS side, and the databases never get a public endpoint. The whole tunnel is provisioned as Terraform in adventive-platform-infra: the AMI by EC2 Image Builder, the EC2 fleet by the cflared-asg module, and the Cloudflare tunnels and their Secrets Manager credentials by the cloudflare-tunnels module.
Chapters
Section titled “Chapters”| # | Topic | Status |
|---|---|---|
| 01 | Architecture, as-built topology, naming | Active standard |
| 02 | Provisioning an environment: AMI, tunnel, ASG | Active standard |
| 03 | Deployment pipeline and manual operations | Active standard |
| 04 | Health monitoring: New Relic agent and CloudWatch | Active standard |
| 05 | Runbook and recovery | Active standard |
| 06 | Naming, security groups, IAM, glossary, revision history | Active standard |
| 07 | Architecture decision records | Active |
Deployment status
Section titled “Deployment status”| Environment | Tunnel | State |
|---|---|---|
| Development | adv-cflared-dev | Deployed. One host behind an ASG, running the New Relic agent. |
| Staging | adv-cflared-stg | Deployed. One host behind an ASG. |
| Production | adv-cflared-prd | Deployed. Two hosts across two Availability Zones behind an ASG. |
The New Relic Infrastructure agent ships in the shared tunnel-host AMI, so every environment’s hosts run it (host and process metrics). It is a deliberate, ADR-backed addition on top of the standing CloudWatch surface; see Chapter 04 and the decision record.
Related standards
Section titled “Related standards”Cloudflare runs the Workers and Hyperdrive configs that consume the tunnel. The thin Cloudflare Tunnel entry under that section points here.
Hyperdrive pools the database connections that ride the tunnel.
AWS holds the Aurora clusters, the EC2 fleet running cloudflared, and Secrets Manager, which holds the tunnel credentials and the New Relic license key.
New Relic is the observability platform the health layer reports into.
The original planning artifact is Cloudflare Tunnel Rollout under Proposed Infrastructure. This section supersedes it as the operating standard.