14 New Resources and a New Migration Sidekick: tf-migrate!

Hey everyone, I'm Shiichan. I found a piece of news today that should make anyone into Infrastructure as Code grin, so let me share it right away.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On Cloudflare's Changelog, the Terraform Provider v5.19.0 release was announced. There are two big pillars this time. First, 14 new resources were added, spanning AI Gateway, Pipelines, R2 Data Catalog, User Groups, Vulnerability Scanner, Workers Observability, and Zero Trust. Second, the v4-to-v5 migration experience got a major boost, with automatic state upgraders now covering 26 resources and working alongside the new tf-migrate CLI tool.

The story so far

Until now, upgrading the Terraform Provider from v4 to v5 meant manually chasing resource renames, attribute rewrites, and moved block setup, which was a genuinely nerve-wracking task. A cmd/migrate tool existed to help with this, but this release brings a change there too. Its role is being handed over to tf-migrate, and cmd/migrate itself is now marked for removal in a future release (#7062).

What changes

Because tf-migrate now automates resource renames, attribute updates, and moved block generation, both manual effort and the risk of mistakes during an upgrade drop significantly. On top of that, the expanded state upgraders (now covering 26 resources) bridge the state itself, so resources you built under v4 can move to v5 without breaking. Teams already running Cloudflare through Terraform should feel this improvement directly.

Dive Deep

Here are the 14 resources you can now manage:

• cloudflare_ai_gateway (AI Gateway instances)
• cloudflare_certificate_authorities_hostname_associations (mTLS certificate hostname associations)
• cloudflare_custom_page_asset (custom page assets)
• cloudflare_pipeline (Cloudflare Pipelines)
• cloudflare_r2_data_catalog (R2 Data Catalog)
• cloudflare_user_group (user groups)
• cloudflare_user_group_members (user group memberships)
• cloudflare_vulnerability_scanner_credential (vulnerability scanner credentials)
• cloudflare_vulnerability_scanner_credential_set (vulnerability scanner credential sets)
• cloudflare_vulnerability_scanner_target_environment (vulnerability scanner target environments)
• cloudflare_workers_observability_destination (Workers Observability destinations)
• cloudflare_zero_trust_device_ip_profile (Zero Trust device IP profiles)
• cloudflare_zero_trust_device_subnet (Zero Trust device subnets)
• cloudflare_zero_trust_dlp_settings (Zero Trust DLP settings)

The 26 resources now covered by state upgraders include account, custom_hostname, mtls_certificate, workers_custom_domain, and zone_setting, and this also resolves schema ambiguity when v4 and v5 state coexist. There are smaller improvements too: ruleset now supports content_converter and redirects_for_ai_training in configuration rules, and zero_trust_gateway_logging is now importable. The bug fix list includes a nil pointer panic fix in zero_trust_access_policy and drift prevention in certificate_pack's state upgrader — quiet fixes that clean up real pain points people hit in production.

Full migration steps live in the Version 5 Migration Guide, and tf-migrate itself is open on GitHub if you want to poke around the source.

Wrap-up

• Terraform Provider v5.19.0 adds 14 new resources, including AI Gateway, Pipelines, and Zero Trust
• Automatic state upgraders now cover 26 resources for the v4-to-v5 move
• The new tf-migrate tool automates resource renames, attribute updates, and moved block generation
• The old cmd/migrate is deprecated and scheduled for removal in a future release
• This update is a direct win for anyone running Cloudflare through Terraform and looking to finally bump to v5