Cloudflare.MagicCloudNetworking reference

CatalogSync

Source: src/Cloudflare/MagicCloudNetworking/CatalogSync.ts

A Magic Cloud Networking catalog sync — continuously materializes the catalog of discovered cloud resources (filtered by a policy expression) into a destination such as a Zero Trust list.

The destination is provisioned when the sync is created, so destinationType is immutable and forces a replacement; name, description, policy, and updateMode are all patched in place.

Magic Cloud Networking is an entitlement-gated add-on (Magic WAN family). On accounts without the entitlement every API call fails with the typed FeatureNotEnabled error (Cloudflare code 1012, “feature not enabled”).

CatalogSync: Creating a sync

Sync discovered VPC CIDRs into a Zero Trust list

const sync = yield* Cloudflare.MagicCloudNetworking.CatalogSync("VpcCidrs", {
  destinationType: "ZERO_TRUST_LIST",
  updateMode: "AUTO",
  policy: "kind in ('aws_vpc','azurerm_virtual_network','google_compute_network')",
});
// sync.destinationId is the provisioned Zero Trust list

Manual sync without a destination

yield* Cloudflare.MagicCloudNetworking.CatalogSync("DryRun", {
  destinationType: "NONE",
  updateMode: "MANUAL",
});

CatalogSync: Destroy behavior

yield* Cloudflare.MagicCloudNetworking.CatalogSync("VpcCidrs", {
  destinationType: "ZERO_TRUST_LIST",
  updateMode: "AUTO",
  deleteDestination: false,
});

CloudIntegration

Source: src/Cloudflare/MagicCloudNetworking/CloudIntegration.ts

A Magic Cloud Networking cloud integration — registers an AWS, Azure, or GCP account with Cloudflare so Magic Cloud Networking can discover its networking resources (VPCs, subnets, gateways, …).

Creating an integration returns provider-side setup data; credential wiring (awsArn, azureSubscriptionId/azureTenantId, gcpProjectId/gcpServiceAccountEmail) is applied in place. Only cloudType forces a replacement.

Magic Cloud Networking is an entitlement-gated add-on (Magic WAN family). On accounts without the entitlement every API call fails with the typed FeatureNotEnabled error (Cloudflare code 1012, “feature not enabled”).

CloudIntegration: Creating an integration

Register an AWS account

const aws = yield* Cloudflare.MagicCloudNetworking.CloudIntegration("Discovery", {
  cloudType: "AWS",
  description: "production AWS account",
});
// aws.lifecycleState === "PENDING_SETUP" until credentials are wired

Wire credentials after creating the IAM role

yield* Cloudflare.MagicCloudNetworking.CloudIntegration("Discovery", {
  cloudType: "AWS",
  awsArn: "arn:aws:iam::123456789012:role/cloudflare-mcn-discovery",
});

CloudIntegration: GCP

yield* Cloudflare.MagicCloudNetworking.CloudIntegration("GcpDiscovery", {
  cloudType: "GOOGLE",
  gcpProjectId: "my-project",
  gcpServiceAccountEmail: "mcn@my-project.iam.gserviceaccount.com",
});

OnRamp

Source: src/Cloudflare/MagicCloudNetworking/OnRamp.ts

A Magic Cloud Networking on-ramp — connects cloud VPCs/VNets to Magic WAN by provisioning VPN/Transit-Gateway constructs inside the cloud account registered via a CloudIntegration.

On-ramps are heavily eventually consistent: after create/update the on-ramp goes through plan/apply phases that provision real cloud infrastructure (minutes). This resource creates and patches the on-ramp configuration and returns immediately; the apply lifecycle is driven by Cloudflare.

name, description, vpc, route-installation flags, and attachments are patched in place; cloudType, type, dynamicRouting, region, cloudAsn, and hub identity force a replacement.

Magic Cloud Networking is an entitlement-gated add-on (Magic WAN family). On accounts without the entitlement every API call fails with the typed FeatureNotEnabled error (Cloudflare code 1012, “feature not enabled”).

OnRamp: Connecting a single VPC

const onramp = yield* Cloudflare.MagicCloudNetworking.OnRamp("ProdVpc", {
  cloudType: "AWS",
  type: "OnrampTypeSingle",
  region: "us-east-1",
  vpc: discoveredVpcId,
  dynamicRouting: false,
  installRoutesInCloud: true,
  installRoutesInMagicWan: true,
});

OnRamp: Hub topologies

yield* Cloudflare.MagicCloudNetworking.OnRamp("TgwHub", {
  cloudType: "AWS",
  type: "OnrampTypeHub",
  region: "us-east-1",
  dynamicRouting: true,
  installRoutesInCloud: false,
  installRoutesInMagicWan: false,
  attachedVpcs: [vpcA, vpcB],
  manageVpcToHubAttachments: true,
});

OnRamp: Destroy behavior

yield* Cloudflare.MagicCloudNetworking.OnRamp("ProdVpc", {
  cloudType: "AWS",
  type: "OnrampTypeSingle",
  region: "us-east-1",
  vpc: discoveredVpcId,
  dynamicRouting: false,
  installRoutesInCloud: true,
  installRoutesInMagicWan: true,
  destroyOnDelete: true,
});