JA EN
shiichan

Cloudflare Rules can now validate changes before you deploy them!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#devops

Hi, I'm Shii-chan! Today I found a small but genuinely useful update from Cloudflare — great news if you've ever gotten burned by a rule mistake after publishing.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, Cloudflare Rules now validates ruleset changes before they're deployed. When you create or update rules — like custom firewall rules — Cloudflare can now catch invalid expressions, action parameter mistakes, permission issues, unavailable features, and quota limit violations without actually publishing the configuration.

The story so far

Previously, changes made through the dashboard or the API went live as soon as you submitted them. That meant typos in expressions, missing permissions, or quota overages would only surface after the change was already published. This was especially risky for teams managing rules through automation, like Terraform or CI/CD pipelines, where a flawed update could reach production before anyone noticed.

What changes

  • Creating or editing rules from Security > Security rules or Rules > Overview in the dashboard now triggers automatic validation
  • Supported Rulesets API mutation endpoints now accept a dry_run=true query parameter, which runs the same authorization and server-side validation checks as a real change, without persisting or publishing it
  • This means API-driven workflows, like Terraform or CI/CD rule updates, can confirm a ruleset is valid before it ever touches production

Dive Deep

A dry run checks for:

  • Invalid expressions
  • Action parameter errors
  • Permission issues
  • Unavailable features
  • Quota limit violations

The response behavior is a nice detail too: operations that normally return 200 return result: null during a dry run, while operations that normally return 204 keep returning 204.

Here's what it looks like in practice — just add dry_run=true to the request:

curl --request POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets?dry_run=true" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "Custom firewall rules",
    "kind": "zone",
    "phase": "http_request_firewall_custom",
    "rules": [
      {
        "action": "block",
        "expression": "ip.src.country eq \"GB\"",
        "description": "Block requests from the United Kingdom",
        "enabled": true
      }
    ]
  }'

This request validates the ruleset without actually creating it.

Wrap-up

  • Cloudflare Rules now automatically validates ruleset changes before they're deployed
  • The dashboard checks automatically; the API lets you opt in explicitly with dry_run=true
  • Checks cover expression errors, action parameters, permissions, unsupported features, and quota limits
  • If you manage rules through Terraform or CI/CD, this is a straightforward way to catch mistakes before they hit production

Related posts