Skip to content
Cloudflare Docs
Docs DirectoryAPIsSDKs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds
Docs collections
hero image

  1. Terraform v5.15.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.15 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes bug fixes, the stabilization of even more popular resources, and more.

    Features

    • ai_search: Add AI Search endpoints (6f02adb ↗)
    • certificate_pack: Ensure proper Terraform resource ID handling for path parameters in API calls (081f32a ↗)
    • worker_version: Support startup_time_ms (286ab55 ↗)
    • zero_trust_dlp_custom_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_dlp_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_dlp_integration_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_dlp_predefined_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_gateway_policy: Support forensic_copy (5741fd0 ↗)
    • zero_trust_list: Support additional types (category, location, device) (5741fd0 ↗)

    Bug fixes

    • access_rules: Add validation to prevent state drift. Ideally, we'd use Semantic Equality but since that isn't an option, this will remove a foot-gun. (4457791 ↗)
    • cloudflare_pages_project: Addressing drift issues (6edffcf ↗) (3db318e ↗)
    • cloudflare_worker: Can be cleanly imported (4859b52 ↗)
    • cloudflare_worker: Ensure clean imports (5b525bc ↗)
    • list_items: Add validation for IP List items to avoid inconsistent state (b6733dc ↗)
    • zero_trust_access_application: Remove all conditions from sweeper (3197f1a ↗)
    • spectrum_application: Map missing fields during spectrum resource import (#6495 ↗) (ddb4e72 ↗)

    Upgrade to newer version

    We suggest waiting to migrate to v5 while we work on stabilization. This helps with avoiding any blocking issues while the Terraform resources are actively being stabilized ↗. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

    For more information

  1. Terraform v5.14.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes bug fixes, the stabilization of even more popular resources, and more.

    Deprecation notice

    Resource affected: api_shield_discovery_operation

    Cloudflare continuously discovers and updates API endpoints and web assets of your web applications. To improve the maintainability of these dynamic resources, we are working on reducing the need to actively engage with discovered operations.

    The corresponding public API endpoint of discovered operations ↗ is not affected and will continue to be supported.

    Features

    • pages_project: Add v4 -> v5 migration tests (#6506 ↗)

    Bug fixes

    • account_members: Makes member policies a set (#6488 ↗)
    • pages_project: Ensures non empty refresh plans (#6515 ↗)
    • R2: Improves sweeper (#6512 ↗)
    • workers_kv: Ignores value import state for verify (#6521 ↗)
    • workers_script: No longer treats the migrations attribute as WriteOnly (#6489 ↗)
    • workers_script: Resolves resource drift when worker has unmanaged secret (#6504 ↗)
    • zero_trust_device_posture_rule: Preserves input.version and other fields (#6500 ↗) and (#6503 ↗)
    • zero_trust_dlp_custom_profile: Adds sweepers for dlp_custom_profile
    • zone_subscription|account_subscription: Adds partners_ent as valid enum for rate_plan.id (#6505 ↗)
    • zone: Ensures datasource model schema parity (#6487 ↗)
    • subscription: Updates import signature to accept account_id/subscription_id to import account subscription (#6510 ↗)

    Upgrade to newer version

    We suggest waiting to migrate to v5 while we work on stabilization. This helps with avoiding any blocking issues while the Terraform resources are actively being stabilized ↗. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

    For more information

  1. Terraform v5.13.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.13 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes new features, new resources and data sources, bug fixes, updates to our Developer Documentation, and more.

    Breaking Change

    Please be aware that there are breaking changes for the cloudflare_api_token and cloudflare_account_token resources. These changes eliminate configuration drift caused by policy ordering differences in the Cloudflare API.

    For more specific information about the changes or the actions required, please see the detailed Repository changelog ↗.

    Features

    • New resources and data sources added
      • cloudflare_connectivity_directory
      • cloudflare_sso_connector
      • cloudflare_universal_ssl_setting
    • api_token+account_tokens: state upgrader and schema bump (#6472 ↗)
    • docs: make docs explicit when a resource does not have import support
    • magic_transit_connector: support self-serve license key (#6398 ↗)
    • worker_version: add content_base64 support
    • worker_version: boolean support for run_worker_first (#6407 ↗)
    • workers_script_subdomains: add import support (#6375 ↗)
    • zero_trust_access_application: add proxy_endpoint for ZT Access Application (#6453 ↗)
    • zero_trust_dlp_predefined_profile: Switch DLP Predefined Profile endpoints, introduce enabled_entries attribute

    Bug Fixes

    • account_token: token policy order and nested resources (#6440 ↗)
    • allow r2_bucket_event_notification to be applied twice without failing (#6419 ↗)
    • cloudflare_worker+cloudflare_worker_version: import for the resources (#6357 ↗)
    • dns_record: inconsistent apply error (#6452 ↗)
    • pages_domain: resource tests (#6338 ↗)
    • pages_project: unintended resource state drift (#6377 ↗)
    • queue_consumer: id population (#6181 ↗)
    • workers_kv: multipart request (#6367 ↗)
    • workers_kv: updating workers metadata attribute to be read from endpoint (#6386 ↗)
    • workers_script_subdomain: add note to cloudflare_workers_script_subdomain about redundancy with cloudflare_worker (#6383 ↗)
    • workers_script: allow config.run_worker_first to accept list input
    • zero_trust_device_custom_profile_local_domain_fallback: drift issues (#6365 ↗)
    • zero_trust_device_custom_profile: resolve drift issues (#6364 ↗)
    • zero_trust_dex_test: correct configurability for 'targeted' attribute to fix drift
    • zero_trust_tunnel_cloudflared_config: remove warp_routing from cloudflared_config (#6471 ↗)

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

    For more info

  1. Introducing email two-factor authentication

    Cloudflare Fundamentals

    Two-factor authentication (2FA) is one of the best ways to protect your account from the risk of account takeover. Cloudflare has offered phishing resistant 2FA options including hardware based keys (for example, a Yubikey) and app based TOTP (time-based one-time password) options which use apps like Google or Microsoft's Authenticator app. Unfortunately, while these solutions are very secure, they can be lost if you misplace the hardware based key, or lose the phone which includes that app. The result is that users sometimes get locked out of their accounts and need to contact support.

    Today, we are announcing the addition of email as a 2FA factor for all Cloudflare accounts. Email 2FA is in wide use across the industry as a least common denominator for 2FA because it is low friction, loss resistant, and still improves security over username/password login only. We also know that most commercial email providers already require 2FA, so your email address is usually well protected already.

    You can now enable email 2FA on the Cloudflare dashboard:

    1. Go to Profile at the top right corner.
    2. Select Authentication.
    3. Under Two-Factor Authentication, select Set up.

    Sign-in security best practices

    Cloudflare is critical infrastructure, and you should protect it as such. Review the following best practices and make sure you are doing your part to secure your account:

    • Use a unique password for every website, including Cloudflare, and store it in a password manager like 1Password or Keeper. These services are cross-platform and simplify the process of managing secure passwords.
    • Use 2FA to make it harder for an attacker to get into your account in the event your password is leaked.
    • Store your backup codes securely. A password manager is the best place since it keeps the backup codes encrypted, but you can also print them and put them somewhere safe in your home.
    • If you use an app to manage your 2FA keys, enable cloud backup, so that you don't lose your keys in the event you lose your phone.
    • If you use a custom email domain to sign in, configure SSO.
    • If you use a public email domain like Gmail or Hotmail, you can also use social login with Apple, GitHub, or Google to sign in.
    • If you manage a Cloudflare account for work:
      • Have at least two administrators in case one of them unexpectedly leaves your company.
      • Use SCIM to automate permissions management for members in your Cloudflare account.

  1. Revamped Member Management UI

    Cloudflare Fundamentals

    As Cloudflare's platform has grown, so has the need for precise, role-based access control. We’ve redesigned the Member Management experience in the Dashboard to help administrators more easily discover, assign, and refine permissions for specific principals.

    What's New

    Refreshed member invite flow

    We overhauled the Invite Members UI to simplify inviting users and assigning permissions.

    Updated Invite Flow UX

    Refreshed Members Overview Page

    We've updated the Members Overview Page to clearly display:

    • Member 2FA status
    • Which members hold Super Admin privileges
    • API access settings per member
    • Member onboarding state (accepted vs pending invite)
    Updated Member Management Overview

    New Member Permission Policies Details View

    We've created a new member details screen that shows all permission policies associated with a member; including policies inherited from group associations to make it easier for members to understand the effective permissions they have.

    Updated Permission Policies Details Screen

    Improved Member Permission Workflow

    We redesigned the permission management experience to make it faster and easier for administrators to review roles and grant access.

    Updated Member Permission Management UX

    Account-scoped Policies Restrictions Relaxed

    Previously, customers could only associate a single account-scoped policy with a member. We've relaxed this restriction, and now Administrators can now assign multiple account-scoped policies to the same member; bringing policy assignment behavior in-line with user-groups and providing greater flexibility in managing member permissions.

  1. Increased HTTP header size limit to 128 KB

    Cloudflare Fundamentals

    CDN now supports 128 KB request and response headers 🚀

    We're excited to announce a significant increase in the maximum header size supported by Cloudflare's Content Delivery Network (CDN). Cloudflare now supports up to 128 KB for both request and response headers.

    Previously, customers were limited to a total of 32 KB for request or response headers, with a maximum of 16 KB per individual header. Larger headers could cause requests to fail with HTTP 413 (Request Header Fields Too Large) errors.

    What's new?

    • Support for large headers: You can now utilize much larger headers, whether as a single large header up to 128 KB or split over multiple headers.
    • Reduces 413 and 520 HTTP errors: This change drastically reduces the likelihood of customers encountering HTTP 413 errors from large request headers or HTTP 520 errors caused by oversized response headers, improving the overall reliability of your web applications.
    • Enhanced functionality: This is especially beneficial for applications that rely on:
      • A large number of cookies.
      • Large Content-Security-Policy (CSP) response headers.
      • Advanced use cases with Cloudflare Workers that generate large response headers.

    This enhancement improves compatibility with Cloudflare's CDN, enabling more use cases that previously failed due to header size limits.

    To learn more and get started, refer to the Cloudflare Fundamentals documentation.

  1. Single sign-on now manageable in the user experience

    Cloudflare Fundamentals
    Screenshot of new user experience for managing SSO

    During Birthday Week, we announced that single sign-on (SSO) is available for free ↗ to everyone who signs in with a custom email domain and maintains a compatible identity provider ↗. SSO minimizes user friction around login and provides the strongest security posture available. At the time, this could only be configured using the API.

    Today, we are launching a new user experience which allows users to manage their SSO configuration from within the Cloudflare dashboard. You can access this by going to Manage account > Members > Settings.

    For more information

  1. Automated reminders for backup codes

    Cloudflare Fundamentals

    The most common reason users contact Cloudflare support is lost two-factor authentication (2FA) credentials. Cloudflare supports both app-based and hardware keys for 2FA, but you could lose access to your account if you lose these. Over the past few weeks, we have been rolling out email and in-product reminders that remind you to also download backup codes (sometimes called recovery keys) that can get you back into your account in the event you lose your 2FA credentials. Download your backup codes now by logging into Cloudflare, then navigating to Profile > Security & Authentication > Backup codes.

    Sign-in security best practices

    Cloudflare is critical infrastructure, and you should protect it as such. Please review the following best practices and make sure you are doing your part to secure your account.

    • Use a unique password for every website, including Cloudflare, and store it in a password manager like 1Password or Keeper. These services are cross-platform and simplify the process of managing secure passwords.
    • Use 2FA to make it harder for an attacker to get into your account in the event your password is leaked
    • Store your backup codes securely. A password manager is the best place since it keeps the backup codes encrypted, but you can also print them and put them somewhere safe in your home.
    • If you use an app to manage your 2FA keys, enable cloud backup, so that you don't lose your keys in the event you lose your phone.
    • If you use a custom email domain to sign in, configure SSO ↗.
    • If you use a public email domain like Gmail or Hotmail, you can also use social login with Apple, GitHub, or Google to sign in.
    • If you manage a Cloudflare account for work:
      • Have at least two administrators in case one of them unexpectedly leaves your company
      • Use SCIM to automate permissions management for members in your Cloudflare account

  1. Fine-grained Permissioning for Access for Apps, IdPs, & Targets now in Public Beta

    Cloudflare Fundamentals Access

    Fine-grained permissions for Access Applications, Identity Providers (IdPs), and Targets is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources.

    What's New

    Updated Permissions Policy UX

    For more info:

  1. Return markdown

    Cloudflare Fundamentals

    Users can now specify that they want to retrieve Cloudflare documentation as markdown rather than the previous HTML default. This can significantly reduce token consumption when used alongside Large Language Model (LLM) tools.

    Terminal window
    curl https://developers.cloudflare.com/workers/ -H 'Accept: text/markdown'  -v

    If you maintain your own site and want to adopt this practice using Cloudflare Workers for your own users you can follow the example here ↗.

  1. Sign in with GitHub

    Cloudflare Fundamentals

    Cloudflare has launched sign in with GitHub as a log in option. This feature is available to all users with a verified email address who are not using SSO. To use it, simply click on the Sign in with GitHub button on the dashboard login page. You will be logged in with your primary GitHub email address.

    For more information

  1. SSO for all

    Cloudflare Fundamentals

    Single sign-on (SSO) streamlines the process of logging into Cloudflare for Enterprise customers who manage a custom email domain and manage their own identity provider. Instead of managing a password and two-factor authentication credentials directly for Cloudflare, SSO lets you reuse your existing login infrastructure to seamlessly log in. SSO also provides additional security opportunities such as device health checks which are not available natively within Cloudflare.

    Historically, SSO was only available for Enterprise accounts. Today, we are announcing that we are making SSO available to all users for free. We have also added the ability to directly manage SSO configurations using the API. This removes the previous requirement to contact support to configure SSO.

    For more information

  1. Reminders about two-factor authentication backup codes

    Cloudflare Fundamentals

    Two-factor authentication is the best way to help protect your account from account takeovers, but if you lose your second factor, you could be locked out of your account. Lock outs are one of the top reasons customers contact Cloudflare support, and our policies often don't allow us to bypass two-factor authentication for customers that are locked out. Today we are releasing an improvement where Cloudflare will periodically remind you to securely save your backup codes so you don't get locked out in the future.

    For more information

  1. Introducing new headers for rate limiting on Cloudflare's API

    Cloudflare Fundamentals

    Cloudflare's API now supports rate limiting headers using the pattern developed by the IETF draft on rate limiting ↗. This allows API consumers to know how many more calls are left until the rate limit is reached, as well as how long you will need to wait until more capacity is available.

    Our SDKs automatically work with these new headers, backing off when rate limits are approached. There is no action required for users of the latest Cloudflare SDKs to take advantage of this.

    As always, if you need any help with rate limits, please contact Support.

    Changes

    New Headers

    Headers that are always returned:

    • Ratelimit: List of service limit items, composed of the limit name, the remaining quota (r) and the time next window resets (t). For example: "default";r=50;t=30
    • Ratelimit-Policy: List of quota policy items, composed of the policy name, the total quota (q) and the time window the quota applies to (w). For example: "burst";q=100;w=60

    Returned only when a rate limit has been reached (error code: 429):

    • Retry-After: Number of Seconds until more capacity is available, rounded up

    SDK Back offs

    • All of Cloudflare's latest SDKs will automatically respond to the headers, instituting a backoff when limits are approached.

    GraphQL and Edge APIs

    These new headers and back offs are only available for Cloudflare REST APIs, and will not affect GraphQL.

    For more information

  1. Terraform v5.9 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadence to ensure its stability and reliability, including the v5.9 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release, and closing all associated bugs with that resource before moving onto resolving migration issues.

    Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

    This release includes a new resource, cloudflare_snippet, which replaces cloudflare_snippets. cloudflare_snippet is now considered deprecated but can still be used. Please utilize cloudflare_snippet as soon as possible.

    Changes

    • Resources stabilized:
      • cloudflare_zone_setting
      • cloudflare_worker_script
      • cloudflare_worker_route
      • tiered_cache
    • NEW resource cloudflare_snippet which should be used in place of cloudflare_snippets. cloudflare_snippets is now deprecated. This enables the management of Cloudflare's snippet functionality through Terraform.
    • DNS Record Improvements: Enhanced handling of DNS record drift detection
    • Load Balancer Fixes: Resolved created_on field inconsistencies and improved pool configuration handling
    • Bot Management: Enhanced auto-update model state consistency and fight mode configurations
    • Other bug fixes

    For a more detailed look at all of the changes, refer to the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new issue if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

    If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition. These do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.8.4 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare Community related to the v5 release. We have committed to releasing improvements on a two week cadence to ensure stability and reliability.

    One key change we adopted in recent weeks is a pivot to more comprehensive, test-driven development. We are still evaluating individual issues, but are also investing in much deeper testing to drive our stabilization efforts. We will subsequently be investing in comprehensive migration scripts. As a result, you will see several of the highest traffic APIs have been stabilized in the most recent release, and are supported by comprehensive acceptance tests.

    Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

    Changes

    • Resources stabilized:
      • cloudflare_argo_smart_routing
      • cloudflare_bot_management
      • cloudflare_list
      • cloudflare_list_item
      • cloudflare_load_balancer
      • cloudflare_load_balancer_monitor
      • cloudflare_load_balancer_pool
      • cloudflare_spectrum_application
      • cloudflare_managed_transforms
      • cloudflare_url_normalization_settings
      • cloudflare_snippet
      • cloudflare_snippet_rules
      • cloudflare_zero_trust_access_application
      • cloudflare_zero_trust_access_group
      • cloudflare_zero_trust_access_identity_provider
      • cloudflare_zero_trust_access_mtls_certificate
      • cloudflare_zero_trust_access_mtls_hostname_settings
      • cloudflare_zero_trust_access_policy
      • cloudflare_zone
    • Multipart handling restored for cloudflare_snippet
    • cloudflare_bot_management diff issues resolves when running terraform plan and terraform apply
    • Other bug fixes

    For a more detailed look at all of the changes, refer to the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This will help you avoid any blocking issues while the Terraform resources are actively being stabilized.

    If you'd like more information on migrating to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition. These migration scripts do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.8.2 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and reliability. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release and closing all associated bugs with that resource before moving onto resolving migration issues.

    Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

    Changes

    • Resources stabilized:
      • cloudflare_custom_pages
      • cloudflare_page_rule
      • cloudflare_dns_record
      • cloudflare_argo_tiered_caching
    • Addressed chronic drift issues in cloudflare_logpush_job, cloudflare_zero_trust_dns_location, cloudflare_ruleset & cloudflare_api_token
    • cloudflare_zone_subscription returns expected values rate_plan.id from former versions
    • cloudflare_workers_script can now successfully be destroyed with bindings & migration for Durable Objects now recorded in tfstate
    • Ability to configure add_headers under cloudflare_zero_trust_gateway_policy
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

    If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.7.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release, with 13.5% of resources impacted. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and relability, including the v5.7 release.

    Thank you for continuing to raise issues and please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Addressed permanent diff bug on Cloudflare Tunnel config
    • State is now saved correctly for Zero Trust Access applications
    • Exact match is now working as expected within data.cloudflare_zero_trust_access_applications
    • cloudflare_zero_trust_access_policy now supports OIDC claims & diff issues resolved
    • Self hosted applications with private IPs no longer require a public domain for cloudflare_zero_trust_access_application.
    • New resource:
      • cloudflare_zero_trust_tunnel_warp_connector
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding on migration to v5 while we work on stabilization of the v5 provider. This will ensure Cloudflare can work ahead and avoid any blocking issues.

    If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Cloudflare User Groups & SCIM User Groups are now in GA

    Cloudflare Fundamentals

    We're announcing the GA of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, strengthening our RBAC capabilities with stable, production-ready primitives for managing access at scale.

    What's New

    User Groups [GA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group inheriting all permissions granted to the User Group. User Groups can be created manually or via our APIs.

    SCIM User Groups [GA]: Centralize & simplify your user and group management at scale by syncing memberships directly from your upstream identity provider (like Okta or Entra ID) to the Cloudflare Platform. This ensures Cloudflare stays in sync with your identity provider, letting you apply Permission Policies to those synced groups directly within the Cloudflare Dashboard.

    Stability & Scale: These features have undergone extensive testing during the Public Beta period and are now ready for production use across enterprises of all sizes.

    For more info:

  1. Terraform v5.6.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.6.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Broad fixes across resources with recurring diffs, including, but not limited to:
      • cloudflare_zero_trust_access_identity_provider
        • cloudflare_zone
    • cloudflare_page_rules runtime panic when setting cache_level to cache_ttl_by_status
    • Failure to serialize requests in cloudflare_zero_trust_tunnel_cloudflared_config
    • Undocumented field 'priority' on zone_lockdown resource
    • Missing importability for cloudflare_zero_trust_device_default_profile_local_domain_fallback and cloudflare_account_subscription
    • New resources:
      • cloudflare_schema_validation_operation_settings
      • cloudflare_schema_validation_schemas
      • cloudflare_schema_validation_settings
      • cloudflare_zero_trust_device_settings
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Cloudflare User Groups & Enhanced Permission Policies are now in Beta

    Cloudflare Fundamentals

    We're excited to announce the Public Beta launch of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, expanding our RBAC capabilities to simplify user and group management at scale.

    We've also visually overhauled the Permission Policies UI to make defining permissions more intuitive.

    What's New

    User Groups [BETA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group inheriting all permissions granted to the User Group. User Groups can be created manually or via our APIs.

    SCIM User Groups [BETA]: Centralize & simplify your user and group management at scale by syncing memberships directly from your upstream identity provider (like Okta or Entra ID) to the Cloudflare Platform. This ensures Cloudflare stays in sync with your identity provider, letting you apply Permission Policies to those synced groups directly within the Cloudflare Dashboard.

    Revamped Permission Policies UI [BETA]: As Cloudflare's services have grown, so has the need for precise, role-based access control. We've given the Permission Policies builder a visual overhaul to make it much easier for administrators to find and define the exact permissions they want for specific principals.

    Updated Permissions Policy UX

    For more info:

  1. Terraform v5.5.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.5.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Broad fixes across resources with recurring diffs, including, but not limited to:
      • cloudflare_zero_trust_gateway_policy
      • cloudflare_zero_trust_access_application
      • cloudflare_zero_trust_tunnel_cloudflared_route
      • cloudflare_zone_setting
      • cloudflare_ruleset
      • cloudflare_page_rule
    • Zone settings can be re-applied without client errors
    • Page rules conversion errors are fixed
    • Failure to apply changes to cloudflare_zero_trust_tunnel_cloudflared_route
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.4.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.4.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Removes the worker_platforms_script_secret resource from the provider (see migration guide ↗ for alternatives—applicable to both Workers and Workers for Platforms)
    • Removes duplicated fields in cloudflare_cloud_connector_rules resource
    • Fixes cloudflare_workers_route id issues #5134 ↗ #5501 ↗
    • Fixes issue around refreshing resources that have unsupported response types
      Affected resources
      • cloudflare_certificate_pack
      • cloudflare_registrar_domain
      • cloudflare_stream_download
      • cloudflare_stream_webhook
      • cloudflare_user
      • cloudflare_workers_kv
      • cloudflare_workers_script
    • Fixes cloudflare_workers_kv state refresh issues
    • Fixes issues around configurability of nested properties without computed values for the following resources
      Affected resources
      • cloudflare_account
      • cloudflare_account_dns_settings
      • cloudflare_account_token
      • cloudflare_api_token
      • cloudflare_cloud_connector_rules
      • cloudflare_custom_ssl
      • cloudflare_d1_database
      • cloudflare_dns_record
      • email_security_trusted_domains
      • cloudflare_hyperdrive_config
      • cloudflare_keyless_certificate
      • cloudflare_list_item
      • cloudflare_load_balancer
      • cloudflare_logpush_dataset_job
      • cloudflare_magic_network_monitoring_configuration
      • cloudflare_magic_transit_site
      • cloudflare_magic_transit_site_lan
      • cloudflare_magic_transit_site_wan
      • cloudflare_magic_wan_static_route
      • cloudflare_notification_policy
      • cloudflare_pages_project
      • cloudflare_queue
      • cloudflare_queue_consumer
      • cloudflare_r2_bucket_cors
      • cloudflare_r2_bucket_event_notification
      • cloudflare_r2_bucket_lifecycle
      • cloudflare_r2_bucket_lock
      • cloudflare_r2_bucket_sippy
      • cloudflare_ruleset
      • cloudflare_snippet_rules
      • cloudflare_snippets
      • cloudflare_spectrum_application
      • cloudflare_workers_deployment
      • cloudflare_zero_trust_access_application
      • cloudflare_zero_trust_access_group
    • Fixed defaults that made cloudflare_workers_script fail when using Assets
    • Fixed Workers Logpush setting in cloudflare_workers_script mistakenly being readonly
    • Fixed cloudflare_pages_project broken when using "source"

    The detailed changelog ↗ is available on GitHub.

    Upgrading

    If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues either by reporting to our GitHub repository ↗, or by opening a support ticket ↗.

    For more info

  1. Updates to Account Home - Quick actions, traffic insights, Workers projects, and more

    Cloudflare Fundamentals
    Updated Account Home

    Recently, Account Home has been updated to streamline your workflows:

    • Recent Workers projects: You'll now find your projects readily accessible from a new Developer Platform tab on Account Home. See recently-modified projects and explore what you can work our developer-focused products.

    • Traffic and security insights: Get a snapshot of domain performance at a glance with key metrics and trends.

    • Quick actions: You can now perform common actions for your account, domains, and even Workers in just 1-2 clicks from the 3-dot menu.

    • Keep starred domains front and center: Now, when you filter for starred domains on Account Home, we'll save your preference so you'll continue to only see starred domains by default.

    We can't wait for you to take the new Account Home for a spin.

    For more info:

  1. Dozens of Cloudflare Terraform Provider resources now have proper drift detection

    Cloudflare Fundamentals Terraform

    In Cloudflare Terraform Provider ↗ versions 5.2.0 and above, dozens of resources now have proper drift detection. Before this fix, these resources would indicate they needed to be updated or replaced — even if there was no real change. Now, you can rely on your terraform plan to only show what resources are expected to change.

    This issue affected resources ↗ related to these products and features:

    • API Shield
    • Argo Smart Routing
    • Argo Tiered Caching
    • Bot Management
    • BYOIP
    • D1
    • DNS
    • Email Routing
    • Hyperdrive
    • Observatory
    • Pages
    • R2
    • Rules
    • SSL/TLS
    • Waiting Room
    • Workers
    • Zero Trust
Search all changelog entries