Did you know Cloudflare's Terraform v5 provider now supports BGP configuration?

Hey there, it's Shii! I was browsing Cloudflare's Changelog today and found that the Terraform provider keeps quietly getting more capable. It might look like a small release, but it's a genuinely nice update if you run Magic WAN, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced the release of Terraform Provider v5.16.0. This release isn't just about new features, it's mainly focused on bug fixes and stabilizing existing resources.

Cloudflare has kept up a fast 2-3 week release cadence for the v5 provider, and this release is part of that ongoing cadence, packing in improvements driven by community feedback.

The story so far

This Terraform v5 provider is still relatively new, having launched back in January 2025. Since it was a fresh rewrite, only a small number of resources were marked as "stable" right after launch.

So Cloudflare has been taking the approach of gradually growing the list of stable resources with each release, together with the community. According to the original post, the most-used resources are on track to be stable by the end of March 2026, and a migration tool for moving from v4 to v5 is planned to ship around the same time.

What changes

Here's what's new in v5.16.0.

• custom_pages: you can now set waf_challenge as a new error page type identifier (added to both the resource and data source schemas)
• list: the CIDR validator was tightened to check for normalized CIDR notation that requires a proper network address, for both IPv4 and IPv6
• magic_wan_gre_tunnel: added an automatic_return_routing attribute for automatic routing control, a new BGP model attribute for BGP configuration, and a bgp_status computed attribute for BGP connection status
• magic_wan_ipsec_tunnel: got the same automatic_return_routing and BGP configuration support plus bgp_status, along with a new custom_remote_identities attribute for custom identity configuration
• ruleset: added support for request body buffering
• workers_script: added observability logs attributes to the list data source model

On the bug fix side, this release resolves an issue where account_member resources couldn't be imported, a type mismatch in load_balancer where session_affinity_ttl expected Float64 on initial creation but Int64 after a v4 migration, and incorrect handling of special characters in URL encoding for workers_kv.

In short, if you manage Cloudflare through Terraform, more configuration can now live entirely in your Terraform code, and you'll run into fewer of these small but annoying bugs.

Dive Deep

The headline feature here is that both the Magic WAN GRE tunnel and IPsec tunnel now support BGP configuration. Routing used to be mostly static, but with the new automatic_return_routing attribute for automatic routing control plus the new BGP model attribute and bgp_status computed attribute, you can now check the state of dynamic route exchange directly from your Terraform code. The IPsec tunnel also gained custom_remote_identities, letting you specify remote identity information more flexibly.

The waf_challenge addition to custom_pages is an identifier you'd use when you want to replace the WAF challenge screen with your own custom error page. It's a small addition, but it adds one more option to the custom pages lineup.

As for the tightened CIDR validator on the list resource, this should now catch a CIDR entry where the host portion isn't zero (something like 10.0.0.1/24) before you even run apply. That's a quietly welcome catch if you're managing infrastructure as code.

Wrap-up

Here's a recap of what matters in v5.16.0.

• Magic WAN's GRE and IPsec tunnels now support BGP configuration and automatic return routing
• custom_pages gained a waf_challenge error page type
• The list resource's CIDR validator now checks for normalized notation
• Fixed bugs including the account_member import issue and the load_balancer type mismatch
• Stabilization of major resources is on track for the end of March 2026, alongside a v4-to-v5 migration tool

If you run Magic WAN through Terraform, or you're an infrastructure engineer who manages Cloudflare tightly through IaC, this is an update worth checking out, so go ahead and bump your provider version.