Overview

When connecting your Cloudflare R2 buckets to Cloney for data migration, it's essential to follow the principle of least privilege. This guide will walk you through creating R2 API tokens with only the permissions necessary for Cloney to read from or write to your R2 buckets, minimizing security risks.

Security Best Practice

Cloudflare R2 uses S3-compatible API tokens. Create dedicated tokens with specific bucket permissions rather than using account-wide access.

Prerequisites

  • A Cloudflare account with R2 enabled
  • At least one R2 bucket created
  • Knowledge of whether you need read-only (source) or write (destination) access

Step 1: Access R2 API Tokens

  1. Sign in to your Cloudflare Dashboard
  2. Navigate to R2 Object Storage in the sidebar
  3. Click on Manage R2 API Tokens
  4. Click Create API token

Step 2: Configure Token Permissions

Configure your token with the appropriate permissions:

For Source Buckets (Read-Only):

  • Token name: cloney-source-token
  • Permissions: Object Read
  • Specify bucket: Select your source bucket(s)

For Destination Buckets (Read/Write):

  • Token name: cloney-destination-token
  • Permissions: Object Read & Write
  • Specify bucket: Select your destination bucket(s)
Bucket-Specific Tokens

R2 allows you to scope tokens to specific buckets. Always limit tokens to only the buckets needed for migration.

Step 3: Generate and Save Credentials

  1. Review your token configuration
  2. Click Create API Token
  3. Important: Copy and securely store:
    • Access Key ID: Used as the S3 access key
    • Secret Access Key: Used as the S3 secret key
    • Endpoint: Your R2 S3-compatible endpoint
Store Securely

The Secret Access Key is only shown once. Store it in a secure password manager immediately.

Step 4: Note Your R2 Details

You'll need these details to connect your R2 bucket to Cloney:

R2 Connection Details
Account ID: Found in Cloudflare dashboard URL or R2 overview
Endpoint: https://<ACCOUNT_ID>.r2.cloudflarestorage.com
Access Key ID: From the API token you created
Secret Access Key: From the API token you created
Bucket Name: Your R2 bucket name
Ready to Connect

You can now use these credentials in Cloney to connect your Cloudflare R2 bucket securely.

Permission Reference

R2 API token permissions and their purposes:

PermissionDescriptionRequired For
Object ReadRead objects and list bucket contentsSource buckets
Object Read & WriteFull object operations including upload and deleteDestination buckets
Admin ReadView bucket settings and metadataOptional
Admin Read & WriteManage bucket settingsNot recommended

Best Practices

  • Use Bucket-Specific Tokens: Create separate tokens for each bucket or migration job.
  • Rotate Tokens Regularly: Delete and recreate tokens periodically for security.
  • Set TTL (Optional): Configure token expiration for temporary access needs.
  • Monitor Usage: Use Cloudflare Analytics to track R2 API usage and detect anomalies.