Boundary vs Cloudflare Access

Boundary provides authenticated, identity-based access to infrastructure without requiring users to connect directly to its underlying network. It supports just-in-time and least-privilege access, role-based authorization, and single sign-on through OIDC or LDAP. Users can reach TCP, SSH, RDP, HTTPS, RDS, Kubernetes, and database targets through familiar clients such as SSH tools, PuTTY, Remote Desktop, database clients, and web browsers. Boundary can broker credentials and integrate with HashiCorp Vault for short-lived dynamic credentials and credential injection. Target discovery can be automated, with dynamic host catalogs for AWS, Azure, and GCP available in HCP Boundary. Deployment options include managed HCP Boundary, optionally with customer-run workers, and self-managed Boundary Enterprise. The Community Edition is listed at free. HCP Boundary Standard and Plus have usage-based billing, with monthly rates per user depending on edition; Standard includes Vault credential injection and audit-log streaming, while Plus adds session recording. Enterprise is self-managed and has full feature parity with HCP Boundary. Boundary supports Terraform, a REST API, CLI, and SDK.

Cloudflare Access controls access to self-hosted apps, SaaS applications, and infrastructure by checking identity, device posture, and other context on each request. Policies can grant access at the individual resource level, and applications deny access unless a user matches an Allow policy. It supports SAML- and OIDC-compliant identity providers, including enterprise and social providers, as well as Cloudflare as an identity provider. Contractors, partners, and people using unmanaged devices can connect through a browser with social sign-in or a one-time PIN. Access can replace or supplement a legacy VPN by limiting access to specific applications, and its controls also cover infrastructure such as SSH and RDP. Administrators can manage policies centrally and scale them through APIs and Terraform. Publishing a self-hosted public application requires an active Cloudflare domain with full or partial CNAME setup. The free plan is for fewer than 50 users; paid service starts at $7/user/mo (annual).