Skip to content
Cloudflare Docs
Docs DirectoryAPIsSDKs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds
Terraform
hero image

  1. Terraform v5.17.0 now available

    Cloudflare Fundamentals Terraform

    In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we have established a consistent and rapid 2-3 week cadence ↗ for releasing targeted improvements, demonstrating our commitment to stability and reliability.

    With the help of the community, we have a growing number of resources that we have marked as stable ↗, with that list continuing to grow with every release. The most used resources ↗ are on track to be stable by the end of March 2026, when we will also be releasing a new migration tool to help you migrate from v4 to v5 with ease.

    This release brings new capabilities for AI Search, enhanced Workers Script placement controls, and numerous bug fixes based on community feedback. We also begun laying foundational work for improving the v4 to v5 migration process. Stay tuned for more details as we approach the March 2026 release timeline.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    Features

    • ai_search_instance: add data source for querying AI Search instances
    • ai_search_token: add data source for querying AI Search tokens
    • account: add support for tenant unit management with new unit field
    • account: add automatic mapping from managed_by.parent_org_id to unit.id
    • authenticated_origin_pulls_certificate: add data source for querying authenticated origin pull certificates
    • authenticated_origin_pulls_hostname_certificate: add data source for querying hostname-specific authenticated origin pull certificates
    • authenticated_origin_pulls_settings: add data source for querying authenticated origin pull settings
    • workers_kv: add value field to data source to retrieve KV values directly
    • workers_script: add script field to data source to retrieve script content
    • workers_script: add support for simple rate limit binding
    • workers_script: add support for targeted placement mode with placement.target array for specifying placement targets (region, hostname, host)
    • workers_script: add placement_mode and placement_status computed fields
    • zero_trust_dex_test: add data source with filter support for finding specific tests
    • zero_trust_dlp_predefined_profile: add enabled_entries field for flexible entry management

    Bug Fixes

    • account: map managed_by.parent_org_id to unit.id in unmarshall and add acceptance tests
    • authenticated_origin_pulls_certificate: add certificate normalization to prevent drift
    • authenticated_origin_pulls: handle array response and implement full lifecycle
    • authenticated_origin_pulls_hostname_certificate: fix resource and tests
    • cloudforce_one_request_message: use correct request_id field instead of id in API calls
    • dns_zone_transfers_incoming: use correct zone_id field instead of id in API calls
    • dns_zone_transfers_outgoing: use correct zone_id field instead of id in API calls
    • email_routing_settings: use correct zone_id field instead of id in API calls
    • hyperdrive_config: add proper handling for write-only fields to prevent state drift
    • hyperdrive_config: add normalization for empty mtls objects to prevent unnecessary diffs
    • magic_network_monitoring_rule: use correct account_id field instead of id in API calls
    • mtls_certificates: fix resource and test
    • pages_project: revert build_config to computed optional
    • stream_key: use correct account_id field instead of id in API calls
    • total_tls: use upsert pattern for singleton zone setting
    • waiting_room_rules: use correct waiting_room_id field instead of id in API calls
    • workers_script: add support for placement mode/status
    • zero_trust_access_application: update v4 version on migration tests
    • zero_trust_device_posture_rule: update tests to match API
    • zero_trust_dlp_integration_entry: use correct entry_id field instead of id in API calls
    • zero_trust_dlp_predefined_entry: use correct entry_id field instead of id in API calls
    • zero_trust_organization: fix plan issues

    Chores

    • add state upgraders to 95+ resources to lay the foundation for replacing Grit (still under active development)
    • certificate_pack: add state migration handler for SDKv2 to Framework conversion
    • custom_hostname_fallback_origin: add comprehensive lifecycle test and migration support
    • dns_record: add state migration handler for SDKv2 to Framework conversion
    • leaked_credential_check: add import functionality and tests
    • load_balancer_pool: add state migration handler with detection for v4 vs v5 format
    • pages_project: add state migration handlers
    • tiered_cache: add state migration handlers
    • zero_trust_dlp_predefined_profile: deprecate entries field in favor of enabled_entries

    For more information

  1. Terraform v5.16.0 now available

    Cloudflare Fundamentals Terraform

    In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we've established a consistent and rapid 2-3 week cadence ↗ for releasing targeted improvements, demonstrating our commitment to stability and reliability.

    With the help of the community, we have a growing number of resources that we have marked as stable ↗, with that list continuing to grow with every release. The most used resources ↗ are on track to be stable by the end of March 2026, when we will also be releasing a new migration tool to you migrate from v4 to v5 with ease.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes bug fixes, the stabilization of even more popular resources, and more.

    Features

    • custom_pages: add "waf_challenge" as new supported error page type identifier in both resource and data source schemas
    • list: enhance CIDR validator to check for normalized CIDR notation requiring network address for IPv4 and IPv6
    • magic_wan_gre_tunnel: add automatic_return_routing attribute for automatic routing control
    • magic_wan_gre_tunnel: add BGP configuration support with new BGP model attribute
    • magic_wan_gre_tunnel: add bgp_status computed attribute for BGP connection status information
    • magic_wan_gre_tunnel: enhance schema with BGP-related attributes and validators
    • magic_wan_ipsec_tunnel: add automatic_return_routing attribute for automatic routing control
    • magic_wan_ipsec_tunnel: add BGP configuration support with new BGP model attribute
    • magic_wan_ipsec_tunnel: add bgp_status computed attribute for BGP connection status information
    • magic_wan_ipsec_tunnel: add custom_remote_identities attribute for custom identity configuration
    • magic_wan_ipsec_tunnel: enhance schema with BGP and identity-related attributes
    • ruleset: add request body buffering support
    • ruleset: enhance ruleset data source with additional configuration options
    • workers_script: add observability logs attributes to list data source model
    • workers_script: enhance list data source schema with additional configuration options

    Bug Fixes

    • account_member: fix resource importability issues
    • dns_record: remove unnecessary fmt.Sprintf wrapper around LoadTestCase call in test configuration helper function
    • load_balancer: fix session_affinity_ttl type expectations to match Float64 in initial creation and Int64 after migration
    • workers_kv: handle special characters correctly in URL encoding

    Documentation

    • account_subscription: update schema description for rate_plan.sets attribute to clarify it returns an array of strings
    • api_shield: add resource-level description for API Shield management of auth ID characteristics
    • api_shield: enhance auth_id_characteristics.name attribute description to include JWT token configuration format requirements
    • api_shield: specify JSONPath expression format for JWT claim locations
    • hyperdrive_config: add description attribute to name attribute explaining its purpose in dashboard and API identification
    • hyperdrive_config: apply description improvements across resource, data source, and list data source schemas
    • hyperdrive_config: improve schema descriptions for cache settings to clarify default values
    • hyperdrive_config: update port description to clarify defaults for different database types

    For more information

  1. Terraform v5.15.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.15 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes bug fixes, the stabilization of even more popular resources, and more.

    Features

    • ai_search: Add AI Search endpoints (6f02adb ↗)
    • certificate_pack: Ensure proper Terraform resource ID handling for path parameters in API calls (081f32a ↗)
    • worker_version: Support startup_time_ms (286ab55 ↗)
    • zero_trust_dlp_custom_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_dlp_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_dlp_integration_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_dlp_predefined_entry: Support upload_status (7dc0fe3 ↗)
    • zero_trust_gateway_policy: Support forensic_copy (5741fd0 ↗)
    • zero_trust_list: Support additional types (category, location, device) (5741fd0 ↗)

    Bug fixes

    • access_rules: Add validation to prevent state drift. Ideally, we'd use Semantic Equality but since that isn't an option, this will remove a foot-gun. (4457791 ↗)
    • cloudflare_pages_project: Addressing drift issues (6edffcf ↗) (3db318e ↗)
    • cloudflare_worker: Can be cleanly imported (4859b52 ↗)
    • cloudflare_worker: Ensure clean imports (5b525bc ↗)
    • list_items: Add validation for IP List items to avoid inconsistent state (b6733dc ↗)
    • zero_trust_access_application: Remove all conditions from sweeper (3197f1a ↗)
    • spectrum_application: Map missing fields during spectrum resource import (#6495 ↗) (ddb4e72 ↗)

    Upgrade to newer version

    We suggest waiting to migrate to v5 while we work on stabilization. This helps with avoiding any blocking issues while the Terraform resources are actively being stabilized ↗. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

    For more information

  1. Terraform v5.14.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes bug fixes, the stabilization of even more popular resources, and more.

    Deprecation notice

    Resource affected: api_shield_discovery_operation

    Cloudflare continuously discovers and updates API endpoints and web assets of your web applications. To improve the maintainability of these dynamic resources, we are working on reducing the need to actively engage with discovered operations.

    The corresponding public API endpoint of discovered operations ↗ is not affected and will continue to be supported.

    Features

    • pages_project: Add v4 -> v5 migration tests (#6506 ↗)

    Bug fixes

    • account_members: Makes member policies a set (#6488 ↗)
    • pages_project: Ensures non empty refresh plans (#6515 ↗)
    • R2: Improves sweeper (#6512 ↗)
    • workers_kv: Ignores value import state for verify (#6521 ↗)
    • workers_script: No longer treats the migrations attribute as WriteOnly (#6489 ↗)
    • workers_script: Resolves resource drift when worker has unmanaged secret (#6504 ↗)
    • zero_trust_device_posture_rule: Preserves input.version and other fields (#6500 ↗) and (#6503 ↗)
    • zero_trust_dlp_custom_profile: Adds sweepers for dlp_custom_profile
    • zone_subscription|account_subscription: Adds partners_ent as valid enum for rate_plan.id (#6505 ↗)
    • zone: Ensures datasource model schema parity (#6487 ↗)
    • subscription: Updates import signature to accept account_id/subscription_id to import account subscription (#6510 ↗)

    Upgrade to newer version

    We suggest waiting to migrate to v5 while we work on stabilization. This helps with avoiding any blocking issues while the Terraform resources are actively being stabilized ↗. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

    For more information

  1. Terraform v5.13.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.13 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

    Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

    This release includes new features, new resources and data sources, bug fixes, updates to our Developer Documentation, and more.

    Breaking Change

    Please be aware that there are breaking changes for the cloudflare_api_token and cloudflare_account_token resources. These changes eliminate configuration drift caused by policy ordering differences in the Cloudflare API.

    For more specific information about the changes or the actions required, please see the detailed Repository changelog ↗.

    Features

    • New resources and data sources added
      • cloudflare_connectivity_directory
      • cloudflare_sso_connector
      • cloudflare_universal_ssl_setting
    • api_token+account_tokens: state upgrader and schema bump (#6472 ↗)
    • docs: make docs explicit when a resource does not have import support
    • magic_transit_connector: support self-serve license key (#6398 ↗)
    • worker_version: add content_base64 support
    • worker_version: boolean support for run_worker_first (#6407 ↗)
    • workers_script_subdomains: add import support (#6375 ↗)
    • zero_trust_access_application: add proxy_endpoint for ZT Access Application (#6453 ↗)
    • zero_trust_dlp_predefined_profile: Switch DLP Predefined Profile endpoints, introduce enabled_entries attribute

    Bug Fixes

    • account_token: token policy order and nested resources (#6440 ↗)
    • allow r2_bucket_event_notification to be applied twice without failing (#6419 ↗)
    • cloudflare_worker+cloudflare_worker_version: import for the resources (#6357 ↗)
    • dns_record: inconsistent apply error (#6452 ↗)
    • pages_domain: resource tests (#6338 ↗)
    • pages_project: unintended resource state drift (#6377 ↗)
    • queue_consumer: id population (#6181 ↗)
    • workers_kv: multipart request (#6367 ↗)
    • workers_kv: updating workers metadata attribute to be read from endpoint (#6386 ↗)
    • workers_script_subdomain: add note to cloudflare_workers_script_subdomain about redundancy with cloudflare_worker (#6383 ↗)
    • workers_script: allow config.run_worker_first to accept list input
    • zero_trust_device_custom_profile_local_domain_fallback: drift issues (#6365 ↗)
    • zero_trust_device_custom_profile: resolve drift issues (#6364 ↗)
    • zero_trust_dex_test: correct configurability for 'targeted' attribute to fix drift
    • zero_trust_tunnel_cloudflared_config: remove warp_routing from cloudflared_config (#6471 ↗)

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

    For more info

  1. Terraform v5.9 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadence to ensure its stability and reliability, including the v5.9 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release, and closing all associated bugs with that resource before moving onto resolving migration issues.

    Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

    This release includes a new resource, cloudflare_snippet, which replaces cloudflare_snippets. cloudflare_snippet is now considered deprecated but can still be used. Please utilize cloudflare_snippet as soon as possible.

    Changes

    • Resources stabilized:
      • cloudflare_zone_setting
      • cloudflare_worker_script
      • cloudflare_worker_route
      • tiered_cache
    • NEW resource cloudflare_snippet which should be used in place of cloudflare_snippets. cloudflare_snippets is now deprecated. This enables the management of Cloudflare's snippet functionality through Terraform.
    • DNS Record Improvements: Enhanced handling of DNS record drift detection
    • Load Balancer Fixes: Resolved created_on field inconsistencies and improved pool configuration handling
    • Bot Management: Enhanced auto-update model state consistency and fight mode configurations
    • Other bug fixes

    For a more detailed look at all of the changes, refer to the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new issue if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

    If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition. These do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.8.4 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare Community related to the v5 release. We have committed to releasing improvements on a two week cadence to ensure stability and reliability.

    One key change we adopted in recent weeks is a pivot to more comprehensive, test-driven development. We are still evaluating individual issues, but are also investing in much deeper testing to drive our stabilization efforts. We will subsequently be investing in comprehensive migration scripts. As a result, you will see several of the highest traffic APIs have been stabilized in the most recent release, and are supported by comprehensive acceptance tests.

    Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

    Changes

    • Resources stabilized:
      • cloudflare_argo_smart_routing
      • cloudflare_bot_management
      • cloudflare_list
      • cloudflare_list_item
      • cloudflare_load_balancer
      • cloudflare_load_balancer_monitor
      • cloudflare_load_balancer_pool
      • cloudflare_spectrum_application
      • cloudflare_managed_transforms
      • cloudflare_url_normalization_settings
      • cloudflare_snippet
      • cloudflare_snippet_rules
      • cloudflare_zero_trust_access_application
      • cloudflare_zero_trust_access_group
      • cloudflare_zero_trust_access_identity_provider
      • cloudflare_zero_trust_access_mtls_certificate
      • cloudflare_zero_trust_access_mtls_hostname_settings
      • cloudflare_zero_trust_access_policy
      • cloudflare_zone
    • Multipart handling restored for cloudflare_snippet
    • cloudflare_bot_management diff issues resolves when running terraform plan and terraform apply
    • Other bug fixes

    For a more detailed look at all of the changes, refer to the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This will help you avoid any blocking issues while the Terraform resources are actively being stabilized.

    If you'd like more information on migrating to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition. These migration scripts do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.8.2 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and reliability. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release and closing all associated bugs with that resource before moving onto resolving migration issues.

    Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

    Changes

    • Resources stabilized:
      • cloudflare_custom_pages
      • cloudflare_page_rule
      • cloudflare_dns_record
      • cloudflare_argo_tiered_caching
    • Addressed chronic drift issues in cloudflare_logpush_job, cloudflare_zero_trust_dns_location, cloudflare_ruleset & cloudflare_api_token
    • cloudflare_zone_subscription returns expected values rate_plan.id from former versions
    • cloudflare_workers_script can now successfully be destroyed with bindings & migration for Durable Objects now recorded in tfstate
    • Ability to configure add_headers under cloudflare_zero_trust_gateway_policy
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

    If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.7.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release, with 13.5% of resources impacted. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and relability, including the v5.7 release.

    Thank you for continuing to raise issues and please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Addressed permanent diff bug on Cloudflare Tunnel config
    • State is now saved correctly for Zero Trust Access applications
    • Exact match is now working as expected within data.cloudflare_zero_trust_access_applications
    • cloudflare_zero_trust_access_policy now supports OIDC claims & diff issues resolved
    • Self hosted applications with private IPs no longer require a public domain for cloudflare_zero_trust_access_application.
    • New resource:
      • cloudflare_zero_trust_tunnel_warp_connector
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    We suggest holding on migration to v5 while we work on stabilization of the v5 provider. This will ensure Cloudflare can work ahead and avoid any blocking issues.

    If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.6.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.6.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Broad fixes across resources with recurring diffs, including, but not limited to:
      • cloudflare_zero_trust_access_identity_provider
        • cloudflare_zone
    • cloudflare_page_rules runtime panic when setting cache_level to cache_ttl_by_status
    • Failure to serialize requests in cloudflare_zero_trust_tunnel_cloudflared_config
    • Undocumented field 'priority' on zone_lockdown resource
    • Missing importability for cloudflare_zero_trust_device_default_profile_local_domain_fallback and cloudflare_account_subscription
    • New resources:
      • cloudflare_schema_validation_operation_settings
      • cloudflare_schema_validation_schemas
      • cloudflare_schema_validation_settings
      • cloudflare_zero_trust_device_settings
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.5.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.5.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Broad fixes across resources with recurring diffs, including, but not limited to:
      • cloudflare_zero_trust_gateway_policy
      • cloudflare_zero_trust_access_application
      • cloudflare_zero_trust_tunnel_cloudflared_route
      • cloudflare_zone_setting
      • cloudflare_ruleset
      • cloudflare_page_rule
    • Zone settings can be re-applied without client errors
    • Page rules conversion errors are fixed
    • Failure to apply changes to cloudflare_zero_trust_tunnel_cloudflared_route
    • Other bug fixes

    For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

    Issues Closed

    If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

    Upgrading

    If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

    For more info

  1. Terraform v5.4.0 now available

    Cloudflare Fundamentals Terraform

    Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.4.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

    Changes

    • Removes the worker_platforms_script_secret resource from the provider (see migration guide ↗ for alternatives—applicable to both Workers and Workers for Platforms)
    • Removes duplicated fields in cloudflare_cloud_connector_rules resource
    • Fixes cloudflare_workers_route id issues #5134 ↗ #5501 ↗
    • Fixes issue around refreshing resources that have unsupported response types
      Affected resources
      • cloudflare_certificate_pack
      • cloudflare_registrar_domain
      • cloudflare_stream_download
      • cloudflare_stream_webhook
      • cloudflare_user
      • cloudflare_workers_kv
      • cloudflare_workers_script
    • Fixes cloudflare_workers_kv state refresh issues
    • Fixes issues around configurability of nested properties without computed values for the following resources
      Affected resources
      • cloudflare_account
      • cloudflare_account_dns_settings
      • cloudflare_account_token
      • cloudflare_api_token
      • cloudflare_cloud_connector_rules
      • cloudflare_custom_ssl
      • cloudflare_d1_database
      • cloudflare_dns_record
      • email_security_trusted_domains
      • cloudflare_hyperdrive_config
      • cloudflare_keyless_certificate
      • cloudflare_list_item
      • cloudflare_load_balancer
      • cloudflare_logpush_dataset_job
      • cloudflare_magic_network_monitoring_configuration
      • cloudflare_magic_transit_site
      • cloudflare_magic_transit_site_lan
      • cloudflare_magic_transit_site_wan
      • cloudflare_magic_wan_static_route
      • cloudflare_notification_policy
      • cloudflare_pages_project
      • cloudflare_queue
      • cloudflare_queue_consumer
      • cloudflare_r2_bucket_cors
      • cloudflare_r2_bucket_event_notification
      • cloudflare_r2_bucket_lifecycle
      • cloudflare_r2_bucket_lock
      • cloudflare_r2_bucket_sippy
      • cloudflare_ruleset
      • cloudflare_snippet_rules
      • cloudflare_snippets
      • cloudflare_spectrum_application
      • cloudflare_workers_deployment
      • cloudflare_zero_trust_access_application
      • cloudflare_zero_trust_access_group
    • Fixed defaults that made cloudflare_workers_script fail when using Assets
    • Fixed Workers Logpush setting in cloudflare_workers_script mistakenly being readonly
    • Fixed cloudflare_pages_project broken when using "source"

    The detailed changelog ↗ is available on GitHub.

    Upgrading

    If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues either by reporting to our GitHub repository ↗, or by opening a support ticket ↗.

    For more info

  1. Dozens of Cloudflare Terraform Provider resources now have proper drift detection

    Cloudflare Fundamentals Terraform

    In Cloudflare Terraform Provider ↗ versions 5.2.0 and above, dozens of resources now have proper drift detection. Before this fix, these resources would indicate they needed to be updated or replaced — even if there was no real change. Now, you can rely on your terraform plan to only show what resources are expected to change.

    This issue affected resources ↗ related to these products and features:

    • API Shield
    • Argo Smart Routing
    • Argo Tiered Caching
    • Bot Management
    • BYOIP
    • D1
    • DNS
    • Email Routing
    • Hyperdrive
    • Observatory
    • Pages
    • R2
    • Rules
    • SSL/TLS
    • Waiting Room
    • Workers
    • Zero Trust

  1. Cloudflare Terraform Provider now properly redacts sensitive values

    Cloudflare Fundamentals Terraform

    In the Cloudflare Terraform Provider ↗ versions 5.2.0 and above, sensitive properties of resources are redacted in logs. Sensitive properties in Cloudflare's OpenAPI Schema ↗ are now annotated with x-sensitive: true. This results in proper auto-generation of the corresponding Terraform resources, and prevents sensitive values from being shown when you run Terraform commands.

    This issue affected resources ↗ related to these products and features:

    • Alerts and Audit Logs
    • Device API
    • DLP
    • DNS
    • Magic Visibility
    • Magic WAN
    • TLS Certs and Hostnames
    • Tunnels
    • Turnstile
    • Workers
    • Zaraz

  1. Terraform v5 Provider is now generally available

    Cloudflare Fundamentals Terraform
    Screenshot of Terraform defining a Zone

    Cloudflare's v5 Terraform Provider is now generally available. With this release, Terraform resources are now automatically generated based on OpenAPI Schemas. This change brings alignment across our SDKs, API documentation, and now Terraform Provider. The new provider boosts coverage by increasing support for API properties to 100%, adding 25% more resources, and more than 200 additional data sources. Going forward, this will also reduce the barriers to bringing more resources into Terraform across the broader Cloudflare API. This is a small, but important step to making more of our platform manageable through GitOps, making it easier for you to manage Cloudflare just like you do your other infrastructure.

    The Cloudflare Terraform Provider v5 is a ground-up rewrite of the provider and introduces breaking changes for some resource types. Please refer to the upgrade guide ↗ for best practices, or the blog post on automatically generating Cloudflare's Terraform Provider ↗ for more information about the approach.

    For more info

Search all changelog entries