Eliminating Expensive VPNs and Bastion Hosts with Cloudflare Zero Trust Access

Securing engineer access to internal databases, staging environments, Kubernetes dashboards, and admin panels is a vital infrastructure requirement.

Traditional enterprises rely on Corporate VPNs (OpenVPN, Cisco AnyConnect, AWS Client VPN) and SSH Bastion Jump Hosts. However, this perimeter-based model is both costly and insecure:

• High per-user VPN licensing fees.
• Publicly accessible Bastion hosts become continuous targets for automated port scanners.
• Significant engineering overhead managing SSH key distribution, rotation, and server patching.
• VPN connections grant broad subnet network access rather than least-privilege application access.

Cloudflare Zero Trust Access replaces legacy VPNs and bastion infrastructure with an Identity-Aware Proxy (IAP) and outbound-only secure tunnels.

1. Financial Cost Analysis: AWS Client VPN & Bastion vs. Zero Trust

Let us calculate the annual cost of securing 30 engineers connecting to private VPC environments in AWS:

Traditional Architecture (AWS Client VPN + Bastion Host):

• AWS Client VPN Subnet Association: 1 subnet $\times$ $0.15/hr$\times$730h = **$109.50 / month**
• AWS Client VPN Active Connections: 30 users $\times$ 4h/day $\times$ 22 days $\times$ $0.05/hr = **$132.00 / month**
• EC2 Bastion Host (t3.small 24/7): ~$15.00 / month
• NAT Gateway & Egress Transfer: ~$40.00 / month
• Engineering Maintenance (SSH key rotation, VPN client support): ~10 hrs/month ($500+)
• Total Traditional Spend: ~$796.50 / month

Cloudflare Zero Trust Access:

• Cloudflare Zero Trust Free Tier: Free for up to 50 users (Includes full Access, Cloudflare Tunnels, and IdP integrations).
• Cloudflare Tunnel (cloudflared): Free unlimited tunnels.
• Identity Integration: Direct Single Sign-On (SSO) with Google Workspace, GitHub, or Okta.
• Total Cloudflare Spend: $0.00 / month

FinOps Result: 100% savings ($796.50 / month) for teams up to 50 seats.

2. Cloudflare Tunnel (cloudflared): Zero Open Inbound Ports

With Cloudflare Tunnel, you no longer need to open port 22 (SSH) or port 443 (HTTPS) to the public internet on your AWS Security Groups:

1. The lightweight open-source cloudflared daemon runs inside your private VPC subnet.
2. cloudflared establishes outbound-only connections to the nearest Cloudflare data centers over HTTP/2 over TLS.
3. All inbound traffic from the internet is completely blocked at the firewall level (Deny All Inbound on security groups).

3. Configuration Guide: Protecting Internal Admin Dashboards

1. Tunnel Creation and DNS Routing:

# Authenticate daemon
cloudflared tunnel login

# Provision secure tunnel
cloudflared tunnel create internal-vpc-tunnel

# Route internal hostname
cloudflared tunnel route dns internal-vpc-tunnel admin.internal.company.com

2. Tunnel Configuration File (config.yml):

tunnel: 7c9d2a4f-1234-5678-90ab-cdef12345678
credentials-file: /etc/cloudflared/credentials.json

ingress:
  - hostname: admin.internal.company.com
    service: http://localhost:8080
  - hostname: staging-db.internal.company.com
    service: tcp://localhost:5432
  - service: http_status:404

3. Apply Access Policy in Cloudflare Dashboard:

• Require SSO authentication with corporate email domain @company.com.
• Enforce Multi-Factor Authentication (MFA) and Device Posture checks.

4. Browser-Based SSH and Centralized Audit Logging

• Browser-Rendered Terminals: Engineers can access authorized SSH sessions directly in modern browsers without distributing SSH private keys to local developer machines.
• Complete Audit Trail: Every HTTP request, terminal command, and SSH session is logged centrally for SOC2 and ISO 27001 compliance.
• Instant Offboarding: Revoking employee access in Google Workspace or Okta terminates all internal access immediately across all infrastructure.

5. Summary of Best Practices

1. Decommission Public Bastion Hosts: Remove all public IP associations to eliminate automated brute-force attacks.
2. Adopt Least-Privilege Access: Restrict access per-service rather than granting wide VPC network subnet permissions.
3. Automate Tunnels in CI/CD: Run cloudflared as a lightweight sidecar in Kubernetes clusters or systemd services on virtual machines.