JA EN
shiichan

Cloudflare's Terraform Provider hits v5.20.0 with 24 brand-new resources!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#devops#infrastructure

Hi, it's me, I'm so excited! Today's news is a treat for anyone managing Cloudflare with Terraform. A whole batch of new resources just landed at once!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, the Terraform Provider for Cloudflare has reached v5.20.0. Cloudflare ships this provider every 2-3 weeks so you can always manage the platform's latest features as code, but this release is especially hefty: 24 new resources, a bump of the underlying Go SDK to cloudflare-go v7, and a range of bug fixes and state upgraders based on community feedback.

The story so far

When managing Cloudflare resources with Terraform, any feature that didn't yet have a matching Terraform resource had to wait for provider support, or be managed separately through the dashboard or API. Newer Cloudflare capabilities like Secrets Store, DLP data classification, and Flagship feature flags were usable, but you simply couldn't manage them as code through Terraform yet.

What changes

With these 24 new resources, a batch of features that were previously outside Terraform's reach can now be codified. For teams that manage infrastructure carefully with IaC, that means less reliance on manual steps or one-off scripts.

Dive Deep

Here's the new resource lineup, grouped by area.

  • AI Search: cloudflare_ai_search_namespace (manage AI Search namespaces)
  • Certificates: cloudflare_custom_csr (manage custom certificate signing requests)
  • DLS: cloudflare_dls_prefix_binding (Data Localization Suite regional service prefix bindings)
  • Flagship feature flags: cloudflare_flagship_app / cloudflare_flagship_flag
  • Tag management: cloudflare_google_tag_gateway
  • Load balancing: cloudflare_load_balancer_monitor_group
  • IAM: cloudflare_oauth_client
  • Origin: cloudflare_origin_cloud_region (v2 endpoints)
  • Secrets Store: cloudflare_secrets_store / cloudflare_secrets_store_secret
  • Resource sharing: cloudflare_share / cloudflare_share_recipient / cloudflare_share_resource
  • Zero Trust: cloudflare_zero_trust_device_deployment_groups, the DLP-related data_class / data_tag / data_tag_category / sensitivity_group / sensitivity_level / sensitivity_level_order, and resource library resource_library_application / resource_library_category
  • WARP: cloudflare_zero_trust_tunnel_warp_connector_config

The underlying Go SDK was also bumped to cloudflare-go v7, and existing implementations such as regional_hostname were updated to match those v7 imports.

A good number of bug fixes landed too, including these.

  • A missing upgrade path for account_member from v5.0-v5.15
  • A nil pointer panic in authenticated_origin_pulls_settings
  • FQDN normalization in dns_record swallowing hostname-shortening changes
  • Drift caused by the load_shedding attribute on load_balancer_pool
  • worker's observability.traces.propagation_policy being dropped on read

On top of that, email_security_block_sender, email_security_impersonation_registry, and email_security_trusted_domains each got a v4-to-v5 state upgrader, making migration smoother for existing users.

Wrap-up

  • The Terraform v5 Provider is now at v5.20.0, with 24 new resources
  • Secrets Store, DLP data classification, Flagship feature flags, resource sharing, and WARP connector config can now all be managed as code
  • The underlying Go SDK was upgraded to cloudflare-go v7
  • Several real-world pain points were fixed around account_member, load_balancer_pool, and worker
  • Three email_security resources gained v4-to-v5 state upgraders, easing migration
  • If you manage Cloudflare with Terraform, it's worth reading the release notes and considering the upgrade.

Related posts