AI Search Support and Stronger Workers Placement Controls Land in Terraform v5.17.0!

Hey there, it's Shii! Cloudflare's Terraform provider just got another update. This release packs in AI Search support and tighter Workers Script placement controls, plus a ton of quietly useful fixes, and I got pretty excited reading through it all!

Cloudflare Changelog developers.cloudflare.com

What was announced?

This is a post from Cloudflare's Changelog announcing the latest release of the Terraform provider, v5.17.0. There are three big highlights this time around.

• New data sources for AI Search
• Stronger placement controls for Workers Script
• Groundwork for a smoother v4-to-v5 migration

On top of that, a big batch of community-reported bug fixes landed too.

The story so far

Cloudflare's Terraform v5 provider first launched back in January 2025, and since then the team has kept up a pretty fast pace, shipping updates roughly every 2 to 3 weeks based on community feedback.

They've also been steadily marking resources as "stable," and the most-used resources are on track to reach stable status by the end of March 2026. Around that same time, a new migration tool to help move from v4 to v5 is planned for release. This v5.17.0 release is laying some of the groundwork for that.

What changes

Here's what's new in this release.

• AI Search: The new ai_search_instance and ai_search_token data sources let you query AI Search instances and tokens directly from Terraform
• account: A new unit field adds support for tenant unit management, along with automatic mapping from managed_by.parent_org_id to unit.id, making it easier to model your org structure in Terraform
• authenticated_origin_pulls: Three new data sources for querying certificates, hostname-specific certificates, and settings
• workers_kv: The data source now has a value field, so you can pull KV values directly
• workers_script: The data source gained a script field for retrieving script contents, and there's now support for simple rate limit bindings
• workers_script: A placement.target array lets you specify targeted placement (region, hostname, host), and new placement_mode and placement_status computed fields were added
• zero_trust_dex_test: A new data source with filter support for finding specific tests
• zero_trust_dlp_predefined_profile: A new enabled_entries field makes entry management more flexible

If you manage Cloudflare with IaC, these give you finer-grained control right in your code.

Dive Deep

Honestly, bug fixes and internal plumbing take up more of this release than the new features do.

On the bug-fix side, resources like cloudforce_one_request_message, dns_zone_transfers_incoming/outgoing, email_routing_settings, magic_network_monitoring_rule, stream_key, waiting_room_rules, and zero_trust_dlp_integration_entry were fixed to use the correct API field (request_id, zone_id, account_id, entry_id, etc.) instead of id. There's also a batch of fixes aimed at preventing state drift, like certificate normalization for authenticated_origin_pulls_certificate and write-only field handling plus mtls object normalization for hyperdrive_config.

What really stands out is the note about adding state upgraders to "95+ resources." This is foundational work toward replacing Grit, the internal migration tool, and it's still under active development. Resources like certificate_pack, dns_record, load_balancer_pool, pages_project, and tiered_cache got state migration handlers for converting from SDKv2 to the Framework, and load_balancer_pool even added detection to auto-distinguish between v4 and v5 formats. It's unglamorous work, but it's important prep for the migration tool planned for March 2026.

One more note: zero_trust_dlp_predefined_profile's entries field is now deprecated in favor of the new enabled_entries field.

Wrap-up

• New data sources let you query AI Search instances and tokens
• Workers Script now supports targeted placement via placement.target, by region or host
• The new unit field on account makes tenant management easier
• State upgraders were added to 95+ resources, laying groundwork for the v4-to-v5 migration tool planned for March 2026
• Numerous API field mismatches were fixed, reducing the risk of state drift

If you're an infrastructure engineer managing Cloudflare with Terraform, just bumping the provider version gets you a pile of quietly useful bug fixes, so it's worth checking out.