Share Cloudflare Tunnel Logs Without Giving Support Write Access
Support needs the payment service's live tunnel logs, but your only role for that also lets them reconfigure every tunnel. Which role grants just the logs?
- The Read And Monitor role became generally available on October 22.
- It adds remote log streaming to selected tunnels without granting configuration changes.
- Account-wide permissions remain in force and must be considered separately.
Support can inspect a tunnel without changing it
A support operator no longer needs configuration write access merely to investigate a selected tunnel’s live logs. Cloudflare’s October 22 announcement makes the Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role generally available.
It permits inspection of selected tunnels, their IP and hostname routes, and connector host details. Remote log streaming is the addition over the existing granular Read role. Ordinary Read access does not include that capability.
For a support team investigating a payment service, the practical choice is to assign investigation access to that service’s tunnel. The role itself does not authorize changing its configuration.
Select the member, role and tunnel scope
Use the standard member permission flow:
- Open Manage Account → Members and edit the member or invite a new one.
- Add a permission policy with the Read And Monitor role.
- Set Scope to Specific resources.
- Choose Cloudflare Tunnel instances as the resource type.
- Select the required tunnels and save.
A member can hold multiple granular policies for different tunnels. This supports responsibilities that differ by service rather than requiring one role for the entire account.
A narrow grant does not cancel a broad one
Adding this policy to an administrator does not make that person read-only. Granular permissions add capabilities; they do not remove capabilities supplied by an existing account-level role.
Inspect the member’s existing assignments before concluding that only the selected tunnel is accessible. Account-level tunnel access continues to expose all tunnels in listing results.
The roles reference distinguishes account, domain and resource scopes. Treat the new role as a precise grant for an investigation, not as an overriding restriction on every other permission the member holds.
Start with Live logs, then locate the failing connection
In the dashboard log interface, open Networking → Tunnels, select the tunnel, and choose Live logs → Live. Remote streaming avoids SSH access to the host. The tunnel must be active and able to receive requests.
For a tunnel with multiple replicas, logs are grouped by hostname and can be narrowed with the Replicas filter. A live stream is also different from retained logs covering a past incident.
Finally, Healthy describes connectivity between the connector and Cloudflare. It does not establish that the internal application is reachable. Giving support the right logs makes that second connection available for investigation; the green tunnel status alone does not answer it.