Create a file access.json in the root directory of your public html folder where your site is served.

{
  "host": "example.com",
  "blacklist": ["/access.json"],
  "rules": [
    ...
  ]
}

Where rules are executed in order on each request.

Make sure blacklist at least contains your access.json file, otherwise it will be exposed to the public through any allow: true rules.

WORKER=worker-name-on-cloudflare
CLOUDFLARE_AUTH_KEY=auth-key-on-cloudflare
CLOUDFLARE_AUTH_EMAIL=auth-email-on-cloudflare
CLOUDFLARE_ACCOUNT_ID=account-id-on-cloudflare
CLOUDFLARE_ZONE_ID=zone-id-on-cloudflare
SITE=url-and-path-to-default-site

access.json is to be found at the root of the site given in SITE

yarn sls deploy

{
  "remoteAddress": ["ip_address"],
  ...
}

{
  "query": {
    "name": "value",
    ...
  },
  ...
}

{
  "cookies": {
    "name": "value",
    ...
  },
  ...
}

{
  "path": "/path/to/files",
  ...
}

To redirect to the pathname and hash of the matched document:

{
  "redirect": ":pathname"
}

To redirect to a relative or absolute url:

{
  "redirect": "http://example.com"
}

To proxy a HTTP site:

{
  "serve": "https://example.com/path/to/files"
}

To pass through to the default site where the access.json is found:

{
  "allow": true
}