Cloudflare extends CASB data scanning to AWS and GCP storage

Cloudflare has wrapped up Security Week 2025 by expanding its data security products within the Cloudflare One SASE platform. The latest update brings Cloud Access Security Broker (CASB) scanning capabilities to Amazon Web Services (AWS) S3 and Google Cloud Storage, allowing organizations to identify both misconfigurations and sensitive data exposure in their cloud environments.

The new integration supports point-in-time and continuous scanning for Identity and Access Management (IAM) issues, bucket and object settings errors, and sensitive content such as Social Security numbers, credit card numbers, or custom patterns defined via regex. All of this is delivered through the existing CASB interface, with setup available from a free Cloudflare account.

Governance and DLP for cloud object storage

Cloudflare CASB has gained traction among security and IT teams for its straightforward approach to SaaS security — scanning well-known platforms like Microsoft 365 and Google Workspace for publicly shared files and exposed data. But customer feedback pointed to a significant gap: data stored at rest in cloud infrastructure often carries higher stakes than SaaS data. Intellectual property, customer records, and personal identifiers stored in AWS or GCP demand the same — or greater — level of oversight.

To close that gap, Cloudflare has integrated Cloud DLP functionality into the CASB product. This enables object-level scanning of S3 buckets and Google Cloud Storage for sensitive data matches. Users can rely on pre-built detection profiles for common data types such as Social Security numbers or credit card numbers, or construct their own regex-based custom profiles. When an object triggers a DLP match, the dashboard surfaces full contextual details including file ownership, enabling faster response.

Posture management for cloud environments

The expansion also brings configuration and posture management to AWS and GCP workloads. The feature flags publicly accessible buckets, disabled logging settings, aging access keys that need rotation, and users lacking multi-factor authentication (MFA) — all without requiring additional configuration.

Out of the box, the system scans using sensible defaults but allows granular adjustments. Teams can select which buckets or file types to scan, and can choose to analyze a percentage of objects rather than the full set. Scanning runs inside the customer's own cloud environment, meaning data never leaves their infrastructure — a design that keeps egress costs down and sensitive data contained within organizational boundaries.

Cloudflare says the roadmap includes extending coverage to Azure Blob Storage and Cloudflare R2 as part of a broader multi-cloud security strategy.

Serverless pipeline architecture

To deliver real-time detection at scale, Cloudflare chose a serverless architecture. All processing lives in what the company calls a Compute Account — a cloud account owned by the customer. A Terraform template provisions this account in under 15 minutes.

The pipeline works through a sequence of serverless functions:

  • Controller: Runs every minute, calling Cloudflare's APIs to fetch the latest DLP configurations and security profiles from the Cloudflare One account.
  • Crawler: Triggered by the controller, this function queries cloud storage APIs to discover new objects. Redis within the Compute Account tracks which objects still need evaluation.
  • Scanner: Newly identified objects pass through a queue to this function, which downloads and streams contents to the DLP engine for matching against predefined or custom profiles.
  • Findings: When matches occur, metadata — including object context and ownership details — gets queued and relayed to a Cloudflare-hosted service, appearing as findings in the Cloudflare Dashboard for security teams to act on.

The privacy-focused design keeps sensitive data inside the customer's cloud boundary. All communication between the Compute Account and Cloudflare's APIs is initiated by the controller, so no inbound traffic configuration is needed.

Getting started

Organizations interested in trialing the new functionality can log into the Cloudflare One dashboard — or create a free account — and navigate to the CASB page to set up their first AWS or GCP integration. Existing customers are encouraged to reach out to their account team for details on the feature and the roadmap ahead.