Connectivity
Reach the console and SSO callbacks without opening the whole fabric — tunnels and VPN as product objects.
Reach the console and SSO callbacks without opening the whole fabric. Credentials stay in AMS; Cedar authorizes tunnel actions — connectivity never replaces product IAM.
Tunnels and VPN as product objects
This hub points at the dedicated Tunnels and VPN product pages. Credentials stay in AMS; Cedar authorizes actions.
Cloudflare tunnels
Named TunnelProfile objects — platform or tenant scope — with AMS-backed connector tokens, validate to Ready, zones, and hostname bindings.
WireGuard VPN
VPNProfile objects for private site paths — AMS peer material, listen ports, and host attachments.
AMS + Cedar
Write-only token fields in AMS. Destroy clears secrets. Tunnel and VPN actions go through Cedar like every other product API.