Cloudflare Products and Architecture
Select and combine services around traffic paths, state invariants, operational ownership, and measurable customer outcomes.
Select an Internet application delivery stack
How would you protect a publisher without caching private checkout responses?
Compose Workers, Pages, and asynchronous applications
Design a quote-generation workflow that survives a consumer crash.
Choose storage by invariants, not familiar names
Choose storage for an application with uploads, relational orders, and live rooms.
Separate user access, Internet egress, and network connectivity
How do Access, Gateway, and Tunnel fit together for contractors?
Combine AI services and observability into a defensible architecture
Explain Workers AI, AI Gateway, and Vectorize to a CTO.
Three architectures, three defensible recommendations
Recommend services for a public publisher, a multi-branch manufacturer, and a runbook assistant. Each has different trust boundaries and operational constraints.
Work through the problem
- For the publisher, separate anonymous assets, authenticated checkout, and callbacks; state CDN and WAF tests.
- For the manufacturer, draw contractor access, employee egress, and branch routing independently.
- For the assistant, draw ingestion and query paths, document authorization, and evaluation gates.
- For each architecture, name a simpler alternative, a rejected product, a pricing assumption to verify, and a rollback owner.
Deliverables
- Three labeled architecture diagrams
- A product decision table with alternatives
- A PoC plan with measurable acceptance and rollback criteria
Self-review rubric
- Correct product boundaries and names
- Explicit consistency and authorization requirements
- No invented plan or pricing promises
- Tests connect technical behavior to business outcomes
Compare with the worked approach
A publisher may combine proxied DNS, CDN, WAF, and DDoS protection while preserving uncached private transactions. A manufacturer may combine Access and Tunnel for application access, Gateway for egress, and Cloudflare WAN for site connectivity; Magic Transit is evaluated for network protection requirements. An assistant may combine Workers, document storage, Vectorize, and inference with AI Gateway visibility. These are conditional designs: workload, identity, topology, data sensitivity, plan eligibility, and measured results determine the final choice.
Use the 24-product field guide for detailed CTO/CFO explanations, alternatives and tradeoffs.