# AI Search Support and Stronger Workers Placement Controls Land in Terraform v5.17.0!

Hey there, it's Shii! Cloudflare's Terraform provider just got another update. This release packs in AI Search support and tighter Workers Script placement controls, plus a ton of quietly useful fixes, and I got pretty excited reading through it all!

## What was announced?

This is a post from Cloudflare's Changelog announcing the latest release of the Terraform provider, v5.17.0. There are three big highlights this time around.

- New data sources for AI Search
- Stronger placement controls for Workers Script
- Groundwork for a smoother v4-to-v5 migration

On top of that, a big batch of community-reported bug fixes landed too.

## The story so far

Cloudflare's Terraform v5 provider first launched back in January 2025, and since then the team has kept up a pretty fast pace, shipping updates roughly every 2 to 3 weeks based on community feedback.

They've also been steadily marking resources as "stable," and the most-used resources are on track to reach stable status by the end of March 2026. Around that same time, a new migration tool to help move from v4 to v5 is planned for release. This v5.17.0 release is laying some of the groundwork for that.

## What changes

Here's what's new in this release.

- **AI Search**: The new `ai_search_instance` and `ai_search_token` data sources let you query AI Search instances and tokens directly from Terraform
- **account**: A new `unit` field adds support for tenant unit management, along with automatic mapping from `managed_by.parent_org_id` to `unit.id`, making it easier to model your org structure in Terraform
- **authenticated_origin_pulls**: Three new data sources for querying certificates, hostname-specific certificates, and settings
- **workers_kv**: The data source now has a `value` field, so you can pull KV values directly
- **workers_script**: The data source gained a `script` field for retrieving script contents, and there's now support for `simple` rate limit bindings
- **workers_script**: A `placement.target` array lets you specify targeted placement (region, hostname, host), and new `placement_mode` and `placement_status` computed fields were added
- **zero_trust_dex_test**: A new data source with filter support for finding specific tests
- **zero_trust_dlp_predefined_profile**: A new `enabled_entries` field makes entry management more flexible

If you manage Cloudflare with IaC, these give you finer-grained control right in your code.

## Dive Deep

Honestly, bug fixes and internal plumbing take up more of this release than the new features do.

On the bug-fix side, resources like `cloudforce_one_request_message`, `dns_zone_transfers_incoming`/`outgoing`, `email_routing_settings`, `magic_network_monitoring_rule`, `stream_key`, `waiting_room_rules`, and `zero_trust_dlp_integration_entry` were fixed to use the correct API field (`request_id`, `zone_id`, `account_id`, `entry_id`, etc.) instead of `id`. There's also a batch of fixes aimed at preventing state drift, like certificate normalization for `authenticated_origin_pulls_certificate` and write-only field handling plus `mtls` object normalization for `hyperdrive_config`.

What really stands out is the note about adding state upgraders to "95+ resources." This is foundational work toward replacing Grit, the internal migration tool, and it's still under active development. Resources like `certificate_pack`, `dns_record`, `load_balancer_pool`, `pages_project`, and `tiered_cache` got state migration handlers for converting from SDKv2 to the Framework, and `load_balancer_pool` even added detection to auto-distinguish between v4 and v5 formats. It's unglamorous work, but it's important prep for the migration tool planned for March 2026.

One more note: `zero_trust_dlp_predefined_profile`'s `entries` field is now deprecated in favor of the new `enabled_entries` field.

## Wrap-up

- New data sources let you query AI Search instances and tokens
- Workers Script now supports targeted placement via `placement.target`, by region or host
- The new `unit` field on `account` makes tenant management easier
- State upgraders were added to 95+ resources, laying groundwork for the v4-to-v5 migration tool planned for March 2026
- Numerous API field mismatches were fixed, reducing the risk of state drift

If you're an infrastructure engineer managing Cloudflare with Terraform, just bumping the provider version gets you a pile of quietly useful bug fixes, so it's worth checking out.