v5.28.0

Compare Source

Full Changelog: v5.27.0...v5.28.0

⚠ BREAKING CHANGES

• api_shield_discovery_operation: operation_id has been renamed to discovery_id, zone_id is now required, and the computed id attribute has been removed. Update resource arguments and any expressions referencing id. This resource remains deprecated and cannot be imported. No new state upgrader is included for these schema changes.
• email_security_trusted_domains: is_recent, is_regex, and is_similarity are now required instead of optional. Set all three explicitly, using false for protections that should not be bypassed.
• registrar_domain, registrar_domains: the cloudflare_registrar_domain resource and data source, and the cloudflare_registrar_domains list data source, have been removed. Configurations using these types must be updated before upgrading; this release does not provide a replacement Terraform resource or data source.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed word_list attribute is now a list of strings instead of a JSON-encoded string, on resources and their data sources. The same change applies to nested word_list values in the zero_trust_dlp_custom_profile and zero_trust_dlp_predefined_profile data sources. Remove jsondecode(...) around these values and update expressions expecting a string. No new state upgrader is included for this type change.
• zero_trust_organization: mfa_ssh_piv_key_requirements has been replaced with mfa_piv_key_requirements on the resource and data source, restoring the field name accepted by the API. Rename the argument and any references to it; the nested attributes are unchanged. No new state upgrader is included for this rename. This also restores API serialization and empty-list normalization, so PIV requirements use the correct API field name and empty SSH key lists do not cause perpetual diffs.

Notes

• pages_project: the API documentation now clarifies that build image version 1 is retired and affected projects are moved to version 3. Once a project's builds have moved, requests setting deployment_configs.preview.build_image_major_version or deployment_configs.production.build_image_major_version to 1 are rejected. Use version 3 for those projects.
• zero_trust_device_custom_profile: the read-only target_tests attribute is deprecated on the resource and its data sources.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed deprecated attribute no longer defaults to false.

Features

New Resources

• cloudflare_monetization_rules: manage a zone's Payment Required ruleset, including exact, upto, and origin_controlled payment schemes. Supports terraform import using the zone ID.

New Data Sources

• cloudflare_monetization_rules: read a zone's Payment Required ruleset.

New Attributes

• ai_search_instance, ai_search_instances: metadata.created_from_emdash_plugin, with type (native or rest) and version.
• pages_project, pages_projects: read-only build_image_auto_upgrade.from_version and build_image_auto_upgrade.to_version, identifying projects moved from a retired build image.
• worker_version, worker_versions, workers_script: Durable Object binding retry settings, bindings.retry.max_attempts and bindings.retry.timeout_ms. max_attempts counts retries after the initial request and accepts 0–10; zero disables retries. timeout_ms accepts 500–60000 and controls the retry window, not the initial-request timeout.
• workers_kv_namespace, workers_kv_namespaces: mode; set mode = "instant" when creating a namespace to use KV Instant, or omit it for a classic namespace. Changing the resource's mode forces replacement.
• workers_script: bindings_inherit = "strict" makes uploads fail when an inherited binding cannot be resolved, instead of silently dropping that binding.
• zero_trust_access_application, zero_trust_access_applications: target_criteria.include, target_criteria.require, and target_criteria.exclude, supporting hostname and tag selectors for infrastructure targets. The rule format requires include; require and exclude are optional. Each rule must contain a hostname selector or tags, with selector sizes and empty values validated at plan time. The legacy target_criteria.target_attributes format remains supported for unchanged persisted maps, including non-hostname keys. For new or changed criteria, prefer the rule format. The legacy format and rule format cannot be combined in the same criterion.
• zero_trust_access_identity_provider, zero_trust_access_identity_providers: config.login_page_auto_prompt, defaulting to false on the resource, to automatically prompt for passkey authentication on the Access login page.
• zero_trust_gateway_certificate, zero_trust_gateway_certificates: read-only region, identifying where the certificate authority's key material is pinned.
• zero_trust_resource_library_application, zero_trust_resource_library_applications: lookup query support for finding complete application name mentions in a phrase. Use filter.lookup on the singular data source or lookup on the list data source. It cannot be combined with search.

New Accepted Values

• zero_trust_access_application: session_duration is now supported for infrastructure applications and defaults to 24h, fixing creation failures when the API returns this default. It sets the maximum connection duration and must use s, m, or h in whole seconds.
• zero_trust_access_identity_provider: type accepts passkeys.
• zero_trust_device_custom_profile: match expressions support device.tags.

Bug Fixes

• d1_database: make read_replication optional and computed with a nested custom type, allowing API-returned replication settings to populate state when the block is omitted.
• dns_record: default missing include_shadow_metadata to false during refresh and v4 to v5 migration, avoiding spurious updates for older state. Allow modified_on to change when private_routing or include_shadow_metadata changes, preventing inconsistent-result errors after updates.
• hostname_tls_setting: populate the required setting_id during import, so imported hostname TLS settings can be refreshed and managed.
• pages_domain, r2_data_catalog, stream_caption_language, stream_download, stream_key, zero_trust_access_short_lived_certificate: stop sending JSON request bodies to API operations that do not accept a body.
• pages_project, workers_kv_namespace, workers_script, zero_trust_access_application, zero_trust_access_identity_provider, zero_trust_gateway_certificate: add newly introduced attributes to the v500 migration target models so existing state upgraders match the current schemas.
• ruleset: improve legacy v4 state detection and migration at schema versions 0 and 1, including nested blocks, retired metadata, and v4.52.9 content_converter fields. Preserve configured content_converter values and existing v5 state, including rules managed with lifecycle.ignore_changes.
• worker: preserve changes made only to previews_base_config, including configuration-derived unknown values, so preview-only updates do not incorrectly retain the previous updated_on value or suppress the planned change.
• workers_script: prefer the API's CF-Entrypoint header when refreshing multipart script content, allowing renamed entrypoints to surface as drift instead of failing to find a stale module name. Preserve service-worker body_part format during refresh.
• zero_trust_access_application: clear prior target criteria before decoding refresh responses, so removed rules and selectors become null instead of retaining stale objects in state.

v5.27.0

Compare Source

Full Changelog: v5.26.0...v5.27.0

⚠ BREAKING CHANGES

One change requires a configuration edit. The rest of this release's schema movement is read-only reshaping with no action required — see Schema Changes at the end.

• api_shield_operation: the feature and with_schemas attributes have been removed from the resource. They were never resource state — both are read-shaping query parameters on the list/get endpoints, and there is no create or update endpoint that accepts them. Remove them from any cloudflare_api_shield_operation block; leaving them in place produces an "Unsupported argument" error. The schema version moves from 500 to 501 and an automatic state upgrader strips both fields from existing state, so no manual state editing is required. This also fixes the .with_schemas: was cty.False, but now null error raised when upgrading from v5.26.0.

Notes

• magic_transit_site: changing ha_mode no longer forces replacement. The upstream API added update support, so the site is modified in place.
• magic_transit_site_lan: changing ha_link no longer forces replacement, for the same reason.
• magic_transit_site_wan: health_check_rate is now configurable (previously read-only).
• ai_search_instance: hybrid_search_enabled now reflects the API default of true for newly created instances. Existing instances keep the value already in state, so upgrading does not plan a change.
• zone_dns_settings: nameservers.ns_set is now computed. It applies only to custom nameserver types and is preserved from state when the API does not return it.
• zone_dns_settings: foundation_dns is deprecated and will be removed in a future API version. Set nameservers.type to cloudflare.advanced to turn Advanced Nameservers on, or cloudflare.standard to turn it off.
• ai_gateway: the default for spend_limits.rules.id changed from 865b4d33 to 00000000. Configurations that do not set id explicitly will show a one-time diff on the next plan.
• zero_trust_device_custom_profile: changing an explicitly configured profile_type now forces replacement. The field is set when the profile is created and cannot be changed, so an in-place update was never possible. Configurations that omit profile_type are unaffected.

Features

New Resources

• cloudflare_zero_trust_casb_integration: Zero Trust CASB Integration

New Data Sources

• cloudflare_zero_trust_casb_integration: Zero Trust CASB Integration
• cloudflare_zero_trust_casb_integrations: Zero Trust CASB Integrations (list)

New Attributes

• magic_transit_site_wan: load_balance_inner_flows
• zero_trust_organization: strict_service_token_auth
• zone_dns_settings: nameservers.nameserver_set_id
• ai_search_instance, ai_search_instances: hostname filter
• account_api_token_permission_groups, account_api_token_permission_groups_list, api_token_permission_groups_list: category and is_selectable

New Accepted Values

• flagship_flag: rules.conditions[...].operator accepts has and not_has
• pipeline_sink: type accepts basin_catalog
• worker_version: bindings.type accepts artifacts
• workers_script: bindings.type accepts artifacts, flagship, k2 and messaging
• zone_dns_settings: nameservers.type accepts cloudflare.advanced and custom

Other

• bump cloudflare-go to v7.12.0
• calls_turn_app: add support for terraform import
• zero_trust_casb_policy: reject at plan time configurations where applies_to_all_integrations is false and no integration IDs resolve. Existing policies that omit integration_ids and retain IDs in state continue to plan normally.

Bug Fixes

• api_shield: add missing normalize field to v500 migration target model
• bot_management: wire up AI Crawl Control fields in hand-maintained API plumbing
• bot_management: wire ai_bots_migration_opt_out into the API model
• calls_turn_app: populate key_id from the API's uid after create, so plan, refresh, update and destroy no longer fail with "missing required key_id parameter"
• d1_database: add missing fields to the v500 migration target model
• dns_record: default include_shadow_metadata to false on import
• logpush_dataset_field: deserialize the fields result map
• logpush_job: add decode_null_to_zero to filter_attack_traffic
• notification_policy: add missing token_id to the v500 migration target model
• observatory_scheduled_test: require replacement when frequency or region change, as the API has no update endpoint for scheduled tests
• page_rule: send the API's query_string wildcard
• schema_validation_schemas: default omit_source to false on import
• snippet_rules: remove stale and spurious top-level fields from the migration target model
• turnstile_widget: default page/per_page to their spec values on import
• worker: remove observability.redact_query_string
• worker, worker_version: backfill author fields on create
• worker_version: exclude exports_reconciliation from the v0 legacy schema
• worker_version: add missing V0 fields to fix a migration test panic
• workers_kv: add missing expiration/expiration_ttl to the v500 migration target model
• workers_script: add missing base_path and observability.issues attributes
• workers_script: add missing stream attribute to the bindings schema
• workers_script: add missing force field to the legacy V0 migration struct
• zero_trust_access_ai_controls_mcp_server: only send changed fields on update, so unrelated changes no longer resend and rotate client_secret; redact auth_credentials and client_secret from debug logs
• zero_trust_access_mtls_hostname_settings: import now takes an explicit accounts/<account_id> or zones/<zone_id> prefix. Account and zone IDs are both 32-character hex, so the previous length-based detection always resolved to account scope and zone-scoped resources could not be imported.
• zero_trust_device_custom_profile: stop split tunnel entries inheriting a mutually exclusive field from state, which caused "host and Address both cannot be present" API errors
• zero_trust_organization: add warp_auth_non_browser_401 to the v4 source model, unblocking v4 to v5 migration
• zero_trust_organization: ignore mfa_configuration_allowed/service_token_inactivity on import
• zero_trust_organization: normalize mfa_configuration_allowed, service_token_inactivity, trusted_accounts
• zero_trust_organization: fix refresh-plan instability for 4 attributes
• zero_trust_tunnel_warp_connector: restore ha from metadata.ha on import and read

Schema Changes (no action required)

Upstream Cloudflare API schema changes picked up via the cloudflare-go v7.12.0 bump. These are listed for completeness; none require a change to a working configuration.

Of the 54 removed attributes, 52 are read-only (computed): existing state files load without user action and plans are unaffected, so only configurations that reference them — in an output block or an expression — need updating. The two attributes that become Required were already mandatory server-side, so a request omitting them was always rejected; the failure simply moves from apply time to plan time. The one type change is on data sources only, and HCL converts numeric strings automatically.

• account_member, account_members, account_permission_group, account_permission_groups, account_token, account_tokens, api_token, api_tokens, user_group, user_groups: the generic policies.permission_groups.meta.key / .value pair has been replaced with typed fields — category, deprecated, description, editable, eol_at, label, scopes, visibility. Expressions reading meta.key/meta.value must move to the named field.
• hyperdrive_config, hyperdrive_configs: integration.integration has been renamed to integration.hyperdrive_config_provider.
• queue, queues, queue_consumer, queue_consumers: the read-only settings.email, settings.pagerduty and settings.webhooks detail attributes are no longer surfaced on the cloudflare_queue resource or the queue data sources. Relatedly, notification is no longer an accepted value for the read-only consumers.type attribute on those surfaces. Queue configuration is unaffected — the cloudflare_queue_consumer resource is unchanged and still accepts and manages all three settings blocks.
• cloud_connector_rules: rules is now Required instead of Optional. The API already rejects a request that omits it, so this moves the failure from apply time to plan time rather than breaking a working configuration.
• zone_dns_settings: nameservers.type is now Required instead of Optional. nameservers became a discriminated union upstream and type is its discriminator, so it was already mandatory in practice.
• flagship_flag, flagship_flags: limit changed from String to Int64 and is now constrained to between 1 and 200. These are data sources only, so there is no state to migrate, and HCL converts numeric strings automatically — limit = "10" continues to work.

v5.26.0

Compare Source

Full Changelog: v5.25.0...v5.26.0

Features

New Resources

• cloudflare_field_extractor: Field Extractor
• cloudflare_magic_wan_bgp_filter_profile: Magic WAN BGP Filter Profile
• cloudflare_zero_trust_casb_policy: Zero Trust CASB Policy
• cloudflare_zero_trust_casb_webhook: Zero Trust CASB Webhook
• cloudflare_zero_trust_connectivity_settings: Zero Trust Connectivity Settings
• cloudflare_zone_tracing: Zone Tracing
• cloudflare_zone_tracing_rules: Zone Tracing Rules

New Data Sources

• cloudflare_field_extractor: Field Extractor
• cloudflare_magic_wan_bgp_filter_profile: Magic WAN BGP Filter Profile
• cloudflare_magic_wan_bgp_filter_profiles: Magic WAN BGP Filter Profiles (list)
• cloudflare_zero_trust_casb_policy: Zero Trust CASB Policy
• cloudflare_zero_trust_casb_policies: Zero Trust CASB Policies (list)
• cloudflare_zero_trust_casb_webhook: Zero Trust CASB Webhook
• cloudflare_zero_trust_casb_webhooks: Zero Trust CASB Webhooks (list)
• cloudflare_zero_trust_connectivity_settings: Zero Trust Connectivity Settings
• cloudflare_zone_tracing: Zone Tracing
• cloudflare_zone_tracing_rules: Zone Tracing Rules

New Attributes

• cloudflare_magic_wan_gre_tunnel, cloudflare_magic_wan_ipsec_tunnel
  • bgp.import_filter_id: ID of the BGP filter profile applied to routes received from the customer
  • bgp.export_filter_id: ID of the BGP filter profile applied to routes advertised to the customer

Bug Fixes

• custom_ssl: mark private_key optional to unblock setting custom_csr_id
• email_routing_settings: add missing support_subaddress to resource schema
• load_balancer_monitor: correctly resolve ambiguous version-zero state during v4 to v5 migration
• page_rule: raise edge_cache_ttl maximum to allow one-year values
• provider: send user_agent_operator_suffix unquoted and read fallback from environment variable
• ruleset: normalize legacy query string wildcards during v4 to v5 migration
• zone_lockdown: drop UseNonNullStateForUnknown on created_on to prevent perpetual diff