# Cloudflare's Terraform Provider v5.7.0 finally fixes that Tunnel permanent diff bug!

Yahoo, Shiichan here! Today I found a solid, unglamorous update for everyone running Cloudflare through Terraform.

## What was announced?

On Cloudflare's Changelog, the [Terraform Provider](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) v5.7.0 is now available. This year's v5 Provider launch brought in a lot of community-reported issues, affecting about 13.5% of resources. Cloudflare committed to shipping improvements on a **two-week cadence** to restore stability, and v5.7.0 is part of that effort.

## The story so far

Being a fresh rewrite, the v5 Provider carried a few rough edges. The most annoying one was a **permanent diff bug** on Cloudflare Tunnel configurations, where `terraform plan` kept showing a diff on every run. There were also Zero Trust Access issues: state not being saved correctly, exact-match searches not actually matching, and diffs showing up even when nothing had changed.

## What changes

This release bundles fixes for all of those reported issues. If you manage Cloudflare Tunnel or Zero Trust Access with Terraform, you can now run `terraform apply` without fighting phantom diffs or errors.

## Dive Deep

Here are the key fixes in this release.

- Fixed the permanent diff bug on Cloudflare Tunnel configuration
- State is now saved correctly for Zero Trust Access applications
- Exact match now works within `data.cloudflare_zero_trust_access_applications`
- `cloudflare_zero_trust_access_policy` now supports OIDC claims, and its diff issues are resolved
- Self-hosted applications with private IPs (`cloudflare_zero_trust_access_application`) no longer require a public domain

Closed issues include a missing import for `cloudflare_logpull_retention`, an error on apply for `cloudflare_zero_trust_access_policy` in v5.5.0, the exact-match bug in `data.cloudflare_zero_trust_access_applications`, and `cloudflare_zero_trust_access_identity_provider` detecting changes on every plan.

A new resource, `cloudflare_zero_trust_tunnel_warp_connector`, was also added, so you can now manage WARP Connectors through Terraform.

## Wrap-up

- Terraform Provider v5.7.0 ships as part of the two-week cadence of stability improvements for v5
- Fixes the Cloudflare Tunnel permanent diff bug plus several Zero Trust Access bugs
- Adds a new `cloudflare_zero_trust_tunnel_warp_connector` resource
- Closes several issues, including missing import support for `cloudflare_logpull_retention`

Great news if you run Cloudflare through Terraform and have been hit by v5's rough edges!