Cloudflare Review

Defending a Cloudflare line item to the board is the easy part of any infra review. NYSE: NET, public since September 2019, profitable on operating cash flow. The 3-year viability question answers itself.

The harder call is scope. Cloudflare One bundles Zero Trust, WAF, and DDoS through the same 330-city network — and Workers AI runs GPU inference at the edge alongside R2 at $0.015 per GB with zero egress. That's a real moat against AWS CloudFront, S3, and Lambda for any team tired of egress invoices.

But the catch is lock-in. Once D1, Workers, and R2 own the data plane, leaving means a rewrite, not a migration. Fastly stays the cleaner second source. Pilot Workers AI on one inference workload. Standardize the security stack only after the 90-day Enterprise quote lands.

R2 charges nothing for egress while S3 charges $0.09 per GB after the first 100 GB free. For a Head of Platform sizing a 3-year storage commitment, that pricing inversion isn't a discount — it's the wedge that breaks AWS lock-in at the data layer.

The architectural picture extends past storage. Workers AI runs NVIDIA H100 GPUs in 180+ cities, AI Gateway handles LLM caching and observability, and Cloudflare One ships zero-trust access against Zscaler and Netskope. The Free plan plus paid tiers from $20/month Pro give developer-led adoption a runway most enterprise vendors envy.

But the catch is the platform bet itself. Workers' V8 isolate runtime isn't AWS Lambda — code targets Cloudflare's primitives, and migrating off is non-trivial. The 330+ city network and Magic Transit defend the moat; the lock-in lives at the runtime layer, not the data.

R2 lists $0.015/GB stored with zero egress. S3 Standard sits at $0.023/GB plus $0.09/GB out for the first 10TB. A workload serving 50TB/month from object storage saves roughly $4,500/month on egress alone — that's the procurement story.

Application tiers are honest: Free, Pro at $25/month, Business at $250/month, Enterprise on contract. Annual commit drops those to $20 and $200. Workers Paid starts at $5/month with 10M requests included, then $0.30 per million. AWS Lambda@Edge runs $0.60 per million.

The catch is per-zone billing. Cloudflare bills by domain, not account — a five-domain Business setup is $1,250/month on monthly terms. Enterprise pricing for Magic Transit and Cloudflare One stays a sales call. But three visible tiers and a free plan that ships real DDoS protection let procurement work without an NDA.

wrangler deploy ships a Workers script to 330+ cities in seconds — V8 isolates spin in under 5ms, not Lambda's container boot. For an engineer pushing edge functions hourly, that's not a perk; it's the only reason this stack makes sense for latency-bound APIs.

R2's S3-compatible API at $0.015/GB and zero egress means the migration from AWS S3 is literally an endpoint URL change in the SDK config. D1 is still SQLite under the hood — fine for read-heavy edge state, but cross-region writes go through a primary, so the geo-distributed write story isn't there yet.

AI Gateway proxies OpenAI and Anthropic calls with caching, retries, and per-key analytics — observability that took a separate tool last year. However, Workers' 128MB memory cap and CPU-time limits force chunking on heavy jobs, and Fastly Compute@Edge still wins for raw WASM throughput.

The Wrangler CLI is what makes the platform feel like a real developer tool, not a dashboard with extras. ``wrangler deploy`` pushes a Worker to 330+ cities in seconds, tail streams logs back from the edge, and the TypeScript types for bindings actually match what you wired up.

Smart Placement is the quiet power move. Turn it on and Cloudflare measures latency and parks the Worker near your origin — 4-8x faster on backend-heavy workloads, no config required. R2 with no egress fees reads as a drop-in replacement for AWS S3 once you're paying real money elsewhere on data transfer.

The tradeoff is sprawl. Workers, Durable Objects with SQLite, D1, KV, R2, Queues, Vectorize, Browser Run — every binding is its own mental model, and the dashboard hides where one ends and the next begins. Lambda@Edge has fewer primitives but a flatter learning curve.

On June 12, 2025, Workers KV failed 91% of requests for two and a half hours. Access, WARP, Workers AI, and Turnstile went with it. The cause was a third-party storage dependency Cloudflare is now migrating onto R2. Blast radius is big.

Credit where earned. The network is real — 477 Tbps, 330+ cities, profitable at scale, Q4 2025 at $614M on 34% YoY growth. Developers like Workers, R2 with zero egress fees, and Cloudflare One. But D1 caps at 10 GB per database with one writer per Durable Object — fine for per-tenant sharding, not a Postgres replacement. AWS RDS this is not.

Exit story is uneven. Static sites and CDN — easy. Apps wired into Workers, Durable Objects, and Queues — lock-in Akamai or Fastly never asked you to take. Growth decelerating to 28-29% for 2026. Strong moat. Price the network risk.