JA EN
shiichan

Terraform v5.13.0 is here — but api_token users need to pay attention!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#devops#infrastructure

Hey, it's me! Today I've got an update on Cloudflare's Terraform provider. There are nice new resources, but there's also a breaking change, so let's dig in carefully!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, a new version of the Terraform provider, v5.13.0, has been released. Since launching the v5 provider earlier this year, Cloudflare has been keeping up a 2-3 week release cadence to address the high number of issues reported by the community, and v5.13 is part of that ongoing effort.

The story so far

Cloudflare previously worked through fixes one issue at a time ("issue-to-issue"), but they've now shifted to a "resource-per-resource" approach: focusing on specific resources to not only stabilize them but also make them migration-friendly for people moving from v4 to v5.

What changes

The headline news this time is a breaking change to the cloudflare_api_token and cloudflare_account_token resources. Differences in how the Cloudflare API orders policies were causing pointless configuration drift on every terraform plan, and this change is meant to eliminate that.

Here's what changed:

  • Policies are now a Set, so ordering is ignored (this stops drift caused by ordering)
  • Policy resources values must now be wrapped in jsonencode()
  • The id, name, and meta fields were removed from policy blocks

Here's the shape of the change:

# Before
resources = { "com.cloudflare.api.account.ACCOUNT_ID" = "*" }

# After
resources = jsonencode({ "com.cloudflare.api.account.ACCOUNT_ID" = "*" })

If you manage these two resources with Terraform, you'll need to review your configuration and rewrite the resource values with jsonencode() before upgrading. For the exact steps, check the detailed repository changelog linked from the release notes.

Three new resources and data sources were also added:

  • cloudflare_connectivity_directory
  • cloudflare_sso_connector
  • cloudflare_universal_ssl_setting

Dive Deep

On the feature side, Magic Transit Connector now supports self-serve license keys, and Worker Version gained content_base64 support — small but handy for real-world use. cloudflare_zero_trust_access_application picked up a proxy_endpoint attribute, and Workers Script Subdomains now support import.

Bug fixes cover a lot of ground too: inconsistent apply errors for DNS records, unintended drift for Pages domains and projects, issues with multipart requests for Workers KV, and drift problems in Zero Trust device profiles and tunnel configuration. On the docs side, resources that don't support import are now being marked explicitly.

For anyone still on v4, the guidance remains the same: there's no need to rush the migration during this stabilization phase.

Wrap-up

Here's the quick recap:

  • The Terraform v5 provider keeps shipping stability improvements on a 2-3 week cadence, and v5.13.0 is the latest
  • The fix strategy shifted from issue-to-issue to resource-per-resource
  • Breaking change: cloudflare_api_token and cloudflare_account_token policies are now a Set requiring jsonencode(), with id, name, and meta removed
  • New resources: cloudflare_connectivity_directory, cloudflare_sso_connector, and cloudflare_universal_ssl_setting
  • Plus a self-serve license key for Magic Transit Connector and a batch of fixes across DNS, Pages, and Workers KV

If you manage API tokens or account tokens with Terraform, be sure to review your configuration before upgrading! And if you want to try the new resources, this release is worth a look.

Related posts