Lookup tables for the tunnel. The narrative for each is in the earlier chapters.
| Resource | Pattern | Example |
|---|
| Cloudflare Tunnel | adv-cflared-{env} | adv-cflared-prd |
| Launch template / ASG | adv-cflared-{env} | adv-cflared-prd |
| Runtime IAM role / instance profile | adv-cflared-runtime-{env} | adv-cflared-runtime-prd |
| Security group | adv-cflared-{env} runtime SG | per environment |
| Image Builder recipe / pipeline | adv-cflared-recipe / adv-cflared-pipeline | shared, env-agnostic |
| Image Builder components | adv-cflared-cloudflared, adv-cflared-bootstrap-script, adv-cflared-newrelic | shared |
| AMI distribution name | adv-cflared-{buildDate} | tagged adv:image=cflared |
| SSM AMI pointer | /adventive/cloudflared/ami-id-latest | shared |
| Secrets Manager tunnel secret | /adventive/cloudflared/{env} | one per environment |
| Secrets Manager New Relic key | /adventive/newrelic/license-key | shared |
| Instance tags | adv:env, adv:project=cloudflare-tunnel, adv:role=tunnel-runtime | on every instance |
| Attribute | Value |
|---|
| Base image | Ubuntu 22.04 LTS (Canonical), latest, via Image Builder recipe |
| Root volume | 20 GiB gp3, encrypted, delete on termination |
| Instance metadata | IMDSv2 required, instance tags exposed via IMDS (the bootstrap reads adv:env) |
| Monitoring | Detailed monitoring (1-minute CloudWatch), CloudWatch agent, New Relic Infra agent |
| Operational access | AWS Systems Manager Session Manager only; no SSH, no inbound ports |
| Config source | cloudflared reads /etc/cloudflared/config.yml, written at boot from Secrets Manager |
The runtime security group is egress-only; there is no inbound rule.
| Direction | Port / Proto | Destination | Purpose |
|---|
| Outbound | 7844 TCP | 0.0.0.0/0 | Cloudflare edge (tunnel control and data) |
| Outbound | 7844 UDP | 0.0.0.0/0 | Cloudflare edge (QUIC) |
| Outbound | 443 TCP | 0.0.0.0/0 | Cloudflare edge fallback; AWS APIs (Secrets Manager, SSM, S3) |
| Outbound | 3306 TCP | Aurora cluster SG | Tunneled MySQL to Aurora |
| Outbound | 53, 123 | VPC resolver, NTP | DNS and time |
| Inbound | none | none | Access is Session Manager only |
The runtime role adv-cflared-runtime-<env> attaches AmazonSSMManagedInstanceCore (Session Manager) plus a scoped inline policy granting secretsmanager:GetSecretValue on exactly two secrets: the environment’s tunnel secret (/adventive/cloudflared/<env>-*) and the shared New Relic license key (/adventive/newrelic/license-key-*). It grants no ec2:*, imagebuilder:*, iam:*, and cannot read another environment’s tunnel secret.
| Term | Definition |
|---|
cloudflared | Cloudflare’s tunnel daemon; opens an outbound session to the edge and proxies TCP to a private origin. |
Named tunnel (config_src = local) | A Cloudflare tunnel whose ingress rules live in the host’s config.yml rather than the dashboard. |
| Connector | A single cloudflared process registered with a tunnel; Cloudflare load-balances across healthy connectors sharing one tunnel. |
| Golden AMI | The immutable, pre-provisioned tunnel-host image built by EC2 Image Builder; instances are never patched in place. |
| Instance refresh | The ASG operation that rolls instances onto a new launch-template or AMI, respecting min_healthy_percentage. |
cflared-bootstrap | The boot-time oneshot that resolves the env tag, fetches Secrets Manager credentials and the New Relic key, and writes the host config before cloudflared starts. |
| Version | Date | Author | Summary |
|---|
| 1.0 | 2026-07-17 | Jeffrey Lambert | Graduated the tunnel plan into the Cloud Connectivity standard. |
| 1.1 | 2026-07-17 | Jeffrey Lambert | Corrected to as-built: EC2 Image Builder on Ubuntu, Terraform-managed tunnels with Secrets Manager, adv-cflared naming, 7844 egress, systemd-plus-EC2 self-heal, and the New Relic Infrastructure agent (host and process metrics). |
