Cloudflare Terraform Provider

Expert guidance for Cloudflare Terraform Provider - infrastructure as code for Cloudflare resources.

Core Principles

• Provider-first: Use Terraform provider for ALL infrastructure - never mix with wrangler.jsonc for the same resources
• State management: Always use remote state (S3, Terraform Cloud, etc.) for team environments
• Modular architecture: Create reusable modules for common patterns (zones, workers, pages)
• Version pinning: Always pin provider version with ~> for predictable upgrades
• Secret management: Use variables + environment vars for sensitive data - never hardcode API tokens

Provider Version

Version	Status	Notes
5.x	Current	Auto-generated from OpenAPI, breaking changes from v4
4.x	Legacy	Manual maintenance, deprecated

Critical: v5 renamed many resources (cloudflare_record → cloudflare_dns_record, cloudflare_worker_* → cloudflare_workers_*). See gotchas.md for migration details.

Provider Setup

Basic Configuration

terraform {
  required_version = ">= 1.0"
  
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.15.0"
    }
  }
}

provider "cloudflare" {
  api_token = var.cloudflare_api_token  # or CLOUDFLARE_API_TOKEN env var
}

Authentication Methods (priority order)

1. API Token (RECOMMENDED): api_token or CLOUDFLARE_API_TOKEN

   • Create: Dashboard → My Profile → API Tokens
   • Scope to specific accounts/zones for security

2. Global API Key (LEGACY): api_key + api_email or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL

   • Less secure, use tokens instead

3. User Service Key: user_service_key for Origin CA certificates

Quick Reference: Common Commands

terraform init          # Initialize provider
terraform plan          # Plan changes
terraform apply         # Apply changes
terraform destroy       # Destroy resources