Tulip's Cloudflare integration allows you to:
Fetch key Cloudflare security configuration data, such as DNS records, WAF rules, and Zero Trust Gateway and Access configuration
Assess the security posture of your Cloudflare configuration against compliance frameworks like CIS, NIST 800-53, SOC2, and ISO 27001
Monitor and detect security-relevant changes, e.g., DNS zone configuration changes
Provide a structured workflow for making and tracking configuration changes, with full change history and impact analysis
Automatically remediate detected security issues in Cloudflare, using Tulip’s integrated workflow
Supported Types
Tulip supports fetching the following Cloudflare configuration types:
Accounts
Zones
Settings
DNS records
User agent blocking rules
Rulesets
Rules and managed rule exceptions
Zero Trust - Gateway
Gateway rules
Custom lists
Locations
Zero Trust - Access
Access policies
Access groups
Applications
Certificate Authorities
From these, Tulip can deploy modifications to Zone Settings and Rule types, supporting secure, auditable configuration changes.
Connect your Cloudflare instance
Tulip supports authenticating with Cloudflare using API tokens:
In your Cloudflare account, go to "Profile" --> "API Tokens" --> "Create Token"
From the API token templates, go to "Read all resources" and click "Use template"
Rename the token to your liking, e.g., "API token for Tulip"
Change at least the following permissions to "Edit":
Account permissions
Account WAF
Account Rulesets
Zero Trust
Access: Organizations, Identity Providers, and Groups
Account Settings
Access: Apps and Policies
User permissions
User Details
Zone permissions
Response Compression
Config Rules
Single Redirect
Cache Rules
Origin Rules
HTTP DDoS Managed Rulesets
Sanitize
Zone Settings
Zone
DNS
Firewall Services
To add Cloudflare as an application, go to the Applications view in Tulip, then click the "Connect new application" button in the top right. Enter an app connection name (e.g., Cloudflare Production), click next, then choose "Cloudflare" as the application.
You will be asked to provide the token you created.