chore(deps): update terraform cloudflare to v5

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cloudflare (source)	required_provider	major	4.52.4 → 5.17.0
cloudflare (source)	required_provider	major	4.38.0 → 5.17.0

---

Release Notes

cloudflare/terraform-provider-cloudflare (cloudflare)

v5.17.0

Compare Source

Full Changelog: v5.16.0...v5.17.0

Features

• account: add RequiresReplace modifier to unit.id field (7cbb327)
• bump schema verion in prep for state upgraders (a721535)
• bump schema verion in prep for state upgraders (a721535)
• chore: bump cloudflare-go dependency for TF (3b4de30)
• chore: skip codegen in authenticated_origin_pulls_certificate (22d11ab)
• chore: skip codegen in authenticated_origin_pulls_hostname_certificate (0fdd92e)
• chore: skip codegen in hostnames authenticated_origin_pulls (82aab9d)
• chore: skip codegen in mtls_certificates (1b14224)
• chore: use 'next' branch of Go SDK in Terraform (809a3f3)
• custom_hostname_fallback_origin: add comprehensive lifecycle test (054611a)
• custom_hostname_fallback_origin: add migration tests and state upgrader logic (855ef8a)
• custom_hostname_fallback_origin: add v4 to v5 migration tests (0542720)
• feat(api): RAG-586: enable terraform for AI Search instances and tokens (fe5239d)
• feat(radar): add BGP RPKI ASPA endpoints and fix SDK casings (e6a03b6)
• fix: authenticated_origin_pulls_settings missing id configuration (abe9087)
• fix(total_tls): use upsert pattern for singleton zone setting (1a79609)
• leaked_credential_check: add import functionality. add tests for import (76e44f0)
• pages_project: use state upgraders (db96be7)
• refactor(terraform): restructure origin_tls_client_auth to peer subresources (6c12fea)
• state upgrader (deee33f)
• state upgrader (d8e4529)
• tiered caching state upgrader (d9d2c74)
• tiered caching state upgrader (d9d2c74)
• tiered_cache: use state upgraders (8cb061c)
• turstile_widget: add v4 to v5 migration tests (a1e27af)
• zero_trust_organization: add migration test (1032e4e)

Bug Fixes

• account: map managed_by.parent_org_id to unid.id in unmarshall and add acctests (a282d8e)
• address PR review comments (62598d7)
• authenticated_origin_pulls_certificate: add certificate normalization to prevent drift (9fa8e39)
• authenticated_origin_pulls_hostname_certificate resource and tests (3380cf9)
• authenticated_origin_pulls: handle array response and implement full lifecycle (e4c82b8)
• byo_ip_prefix: skip LOA tests (892bce0)
• changelog: update changelog to reflect reality (519c85e)
• cloudflare_zero_trust_device_posture_rule: update tests to match API (b2aad0d)
• mtls_certificates resource and test (fc44f27)
• prevent unnecessary diffs on consecutive applies for hyperdrive_config (8755bf9)
• skip tests requiring account creation (f6d48e9)
• upgrade scenario (e3831be)
• workers_script: add support for placement mode/status (1bc17fa)
• workers_script: schema and migration model (a9a0e05)
• zero_trust_access_application: update v4 version on migration tests (45a825e)
• zero_trust_organization: fix plan issues (f6a9369)

Reverts

• pages_project: "fix(pages_project) build_config to computed optional" (b9c13c9)

Chores

• add CODEOWNERS (3abbb08)
• api: update composite API spec (febe2db)
• api: update composite API spec (71cb6a6)
• api: update composite API spec (6c428d6)
• api: update composite API spec (eda1841)
• api: update composite API spec (7cda136)
• api: update composite API spec (935193b)
• api: update composite API spec (7e45f8d)
• api: update composite API spec (e42ae97)
• api: update composite API spec (48153bd)
• fix model/schema parity (b00bd10)
• improve contribution guide (85584b7)
• internal: codegen related update (22b09ad)
• internal: codegen related update (f587465)
• internal: codegen related update (0bca406)
• internal: codegen related update (3ca7e23)
• internal: codegen related update (02605c2)
• internal: codegen related update (366fb6d)
• internal: codegen related update (f55e1be)
• internal: codegen related update (33bc656)
• internal: codegen related update (6eb4afc)
• internal: codegen related update (636b4f8)
• internal: codegen related update (067536c)
• internal: codegen related update (1af8451)
• internal: codegen related update (f36071f)
• internal: codegen related update (246ffcd)
• internal: codegen related update (471df29)
• internal: codegen related update (0211418)
• internal: codegen related update (2bcbbd5)
• internal: codegen related update (09f9d99)
• internal: fix sdk (be5dbc6)
• minimum upgrade test (25504d0)
• tests: no more state file (f439772)
• Update CHANGELOG.md (f4a1b58)

Documentation

• clarify certificate normalization issue in test comments (8bddab1)
• regerate docs (fc702d9)

Refactors

• refactor stateupgraders (c950153)

v5.16.0

Compare Source

Full Changelog: v5.15.0...v5.16.0

Features

• custom_pages: add "waf_challenge" as new supported error page type identifier in both resource and data source schemas
• list: enhance CIDR validator to check for normalized CIDR notation requiring network address for IPv4 and IPv6
• magic_wan_gre_tunnel: add automatic_return_routing attribute for automatic routing control
• magic_wan_gre_tunnel: add BGP configuration support with new BGP model attribute
• magic_wan_gre_tunnel: add bgp_status computed attribute for BGP connection status information
• magic_wan_gre_tunnel: enhance schema with BGP-related attributes and validators
• magic_wan_ipsec_tunnel: add automatic_return_routing attribute for automatic routing control
• magic_wan_ipsec_tunnel: add BGP configuration support with new BGP model attribute
• magic_wan_ipsec_tunnel: add bgp_status computed attribute for BGP connection status information
• magic_wan_ipsec_tunnel: add custom_remote_identities attribute for custom identity configuration
• magic_wan_ipsec_tunnel: enhance schema with BGP and identity-related attributes
• ruleset: add request body buffering support
• ruleset: enhance ruleset data source with additional configuration options
• workers_script: add observability logs attributes to list data source model
• workers_script: enhance list data source schema with additional configuration options

Bug Fixes

• dns_record: remove unnecessary fmt.Sprintf wrapper around LoadTestCase call in test configuration helper function
• load_balancer: fix session_affinity_ttl type expectations to match Float64 in initial creation and Int64 after migration
• workers_kv: handle special characters correctly in URL encoding

Documentation

• account_subscription: update schema description for rate_plan.sets attribute to clarify it returns an array of strings
• api_shield: add resource-level description for API Shield management of auth ID characteristics
• api_shield: enhance auth_id_characteristics.name attribute description to include JWT token configuration format requirements
• api_shield: specify JSONPath expression format for JWT claim locations
• hyperdrive_config: add description attribute to name attribute explaining its purpose in dashboard and API identification
• hyperdrive_config: apply description improvements across resource, data source, and list data source schemas
• hyperdrive_config: improve schema descriptions for cache settings to clarify default values
• hyperdrive_config: update port description to clarify defaults for different database types

v5.15.0

Compare Source

Full Changelog: v5.14.0...v5.15.0

Features

• ai_search: add AI Search endpoints (6f02adb)
• certificate_pack: add terraform config for CRUD support. This ensures proper Terraform resource ID handling for path parameters in API calls. (081f32a)
• leaked_credentials_check: Add GET endpoint for leaked_credentials_check/detections (feafd9c)
• worker_version: support startup_time_ms (286ab55)
• zero_trust_access_group: v4 to v5 migration acceptance tests (9c877c7)
• zero_trust_access_mtls_hostname_settings: use v2 migrator (b14aa6d)
• zero_trust_dlp_custom_entry: support upload_status (7dc0fe3)
• zero_trust_dlp_entry: support upload_status (7dc0fe3)
• zero_trust_dlp_integration_entry: support upload_status (7dc0fe3)
• zero_trust_dlp_predefined_entry: support upload_status (7dc0fe3)
• zero_trust_gateway_policy: support forensic_copy (5741fd0)
• zero_trust_list: support additional types (category, location, device) (5741fd0)

Bug Fixes

• access_rules: Add validation to prevent state drift. Ideally we'd use Semantic Equality but since that isn't an option, this will remove a foot-gun. (4457791)
• cloudflare_pages_project: addressing drift issues (6edffcf) (3db318e)
• cloudflare_worker: can be cleanly imported (4859b52)
• cloudflare_worker: ensure clean imports (5b525bc)
• list_items: Add validation for IP List items to avoid inconsistent state (b6733dc)
• zero_trust_access_application: remove all conditions from sweeper (3197f1a)
• map missing fields during spectrum resource import (#​6495) (ddb4e72)
• update invalid codegen (d365b98) (92f5c9e)

Chores

• certificate_pack: hosts is now a set, not a list (286ab55)
• ci: split acceptance tests into 37 parallel groups for faster (8c6212b)
• healthcheck: add test for expected_body default value (c5afb48) (e99b43f)
• magic_wan_ipsec_tunnel: remove custom_remote_entities (286ab55)
• queue_consumer: Test data fixes for queue consumer acceptance tests (1b92700)
• update go to point to next (25d640a)
• update regional hostnames migration test to use new migrator (d5ac65f)
• update test to use new migrator (d5ac65f) (ec875bb)

Documentation

• Deprecate API Shield Schema Validation resources (366e1b8)
• generate provider docs (c23342e)

Refactors

• healthcheck: consolidate tests and expand update coverage (b747d21) (7fa38b3)

v5.14.0

Compare Source

Full Changelog: v5.13.0...v5.14.0

Features

• add v4->v5 migration tests for pages_project and adjust schema (#​6506) (6de0179)
• chore: point Terraform to Go 'next' (af9a5f8)
• chore: update go sdk to v6.4.0 for provider release (63cb021)
• chore(api_shield_discovery_operation): Deprecate api_shield_discovery_operation (7dc0a63)
• feat: BOTS-7562 add bot management feedback endpoints to stainless config (prod) (f5112e1)
• feat(r2_data_catalog): Configure SDKs/Terraform to use R2 Data Catalog routes (5beb50b)
• feat(radar): Add origins endpoints to public api docs (ee51e5f)
• improve and standardize sweepers (#​6501) (03fb2d2)

Bug Fixes

• account_members: making member policies a set (#​6488) (f3ecaa5)
• decoder and tests (#​6516) (4c3e2db)
• decoder, build (#​6514) (1935459)
• pages_project: non empty refresh plans (#​6515) (bc526ff)
• pages_project: use correct field name in test sweeper (6dc0e53)
• r2 sweeper (#​6512) (fec953c)
• tests: resolve SDK v6 migration test failures (#​6507) (bad9716)
• update import signature to accept account_id/subscription_id in order to import account subscription (#​6510) (c2db582)
• utils: test assertions (4c3e2db)
• workers_kv: ignore value import state verify (#​6521) (c3e3f89)
• workers_script: No longer treating the migrations attribute as WriteOnly (#​6489) (dc60e38)
• workers_script: resource drift when worker has unmanaged secret (#​6504) (505c0fe)
• zero_trust_device_posture_rule: preserve input.version and other fields (#​6500) (4c4e54b)
• zero_trust_device_posture_rule: preserve input.version and other fields (#​6503) (d45be9a)
• zero_trust_dlp_custom_profile: add sweepers for dlp_custom_profile (cbcb325)
• zone_subscription|account_subscription: add partners_ent as valid enum for rate_plan.id (#​6505) (2a70fb4)
• zone: datasource model schema parity (#​6487) (861c68f)

Chores

• account_member: dont run acceptance with env variable (4c3e2db)
• account_member: fix check for env var (#​6517) (07e9aa5)
• account_member: skip until user is dsr enabled (#​6522) (dd7c2fe)
• account_tokens: adding a simple CRUD test (#​6484) (6869538)
• api: update composite API spec (71fc050)
• api: update composite API spec (68d017a)
• cloudflare_api_shield_operation: Add acceptance tests (#​6491) (37e1fdf)
• docs: update documentation (#​6523) (a060e61)
• internal: codegen related update (923ea1d)
• internal: codegen related update (a110cbe)
• internal: codegen related update (7b36c06)
• internal: codegen related update (c789f91)
• internal: codegen related update (a91faa6)
• internal: codegen related update (dfa745a)
• internal: codegen related update (fb3ef1b)
• internal: codegen related update (504e8b6)
• internal: codegen related update (550d77c)
• logpush_job: add v4 to v5 migration tests (#​6483) (2e4b8a0)
• tests: cloud connector rules parity tests and add connectivity_directory_service tests (#​6513) (5341c82)
• update changelog (#​6480) (adba156)
• update changelog (#​6525) (b026b4d)
• zero_trust_device_default_profile_local_domain_fallback: add tests (#​6464) (365cb71)
• zero_trust_device_default|custom_profile: acceptance test coverage (#​6511) (8e4ec1a)
• zero_trust_device_managed_networks: add tests (#​6463) (e9b6783)
• zero_trust_device_posture_integration: update tests for to test with Crowdstrike (#​6470) (e360d6f)
• zone: update migration tests (#​6468) (8ff53df)

v5.13.0

Compare Source

Full Changelog: v5.12.0...v5.13.0

⚠ BREAKING CHANGES: cloudflare_api_token & cloudflare_account_token Schema Update

The 5.13 release includes major updates to the cloudflare_api_token resource to eliminate configuration drift caused by policy ordering differences in the Cloudflare API.

Fixes: #​6092

Whats changed

• policies are now a Set; order is ignored to prevent drift.
• When defining a policy, resources must use jsonencode(); all policy resource values must now be JSON-encoded strings.
• Removed fields: id, name, and meta have been removed from policy blocks.

Required Action (v5.13+)
Customers looking to upgrade to v5.13+ must update all cloudflare_api_token & cloudflare_account_token resources to wrap policy resource values in jsonencode()

Before:

resources = {
  "com.cloudflare.api.account.${var.cf_account_id}" = "*"
}

After:

resources = jsonencode({
  "com.cloudflare.api.account.${var.cf_account_id}" = "*"
})

• account_token: token policy order and nested resources (#​6440)

Features

• add new resources and data sources (7ce3dec)
• api_token+account_tokens: state upgrader and schema bump (#​6472) (42f7db2)
• chore(build): point Terraform to released Go v6.3.0 (6d06b46)
• docs: make docs explicit when a resource does not have import support (02699f6)
• magic_transit_connector: support self-serve license key (#​6398) (a6ec134)
• worker_version: add content_base64 support (6ff643f)
• worker_version: boolean support for run_worker_first (#​6407) (116a67b)
• workers_script_subdomains: add import support (#​6375) (40f7ed8)
• zero_trust_access_application: add proxy_endpoint for ZT Access Application (#​6453) (177f20a)
• zero_trust_dlp_predefined_profile: Switch DLP Predefined Profile endpoints, introduce enabled_entries attribute (bc69569)
• zero_trust_tunnel_cloudflared: v4 to v5 migration tests (#​6461) (ffa0fef)

Bug Fixes

• account_token: token policy order and nested resources (#​6440) (86c5972)
• allow r2_bucket_event_notification to be applied twice without failing (#​6419) (6fbd4c5)
• cloudflare_worker+cloudflare_worker_version: import for the resources (#​6357) (b98e0be)
• dns_record: inconsistent apply error (#​6452) (f289994)
• pages_domain: resource tests (#​6338) (d769e29)
• pages_project: unintended resource state drift (#​6377) (1a3955a)
• queue_consumer: id population (#​6181) (f3c6498)
• workers_kv: multipart request (#​6367) (65f8c19)
• workers_kv: updating workers metadata attribute to be read from endpoint (#​6386) (3a35757)
• workers_script_subdomain: add note to cloudflare_workers_script_subdomain about redundancy with cloudflare_worker (#​6383) (9cc9b59)
• workers_script: allow config.run_worker_first to accept list input (fab567c)
• zero_trust_device_custom_profile_local_domain_fallback: drift issues (#​6365) (65c0c18)
• zero_trust_device_custom_profile: resolve drift issues (#​6364) (4cd2cbd)
• zero_trust_dex_test: correct configurability for 'targeted' attribute to fix drift (cd81178)
• zero_trust_tunnel_cloudflared_config: remove warp_routing from cloudflared_config (#​6471) (dc9d557)

Chores

• account_member: add migration test (#​6425) (967a972)
• byoip: integrate generated changes for BYOIP resources (432160e)
• certificate_pack: docs show safe rotation instructions (#​6388) (3d37264)
• ci: clean up leftover files in resources (#​6474) (e8aee72)
• ci: drop migration tests from CI (#​6476) (968565f)
• ci: fix tests ran on release PR (#​6478) (0b43c46)
• ci: fixes for parity tests and build failures (#​6475) (3561876)
• ci: modify sweepers (#​6479) (4c8915d)
• ci: skip flaky test in CI (fb14d86)
• cloudflare_zero_trust_dlp_custom_profile: migration test and ignore order as set (#​6428) (1659ff3)
• d1: integrate generated changes for D1 resources (cfa3472)
• dns_record: improve dns sweepers (#​6430) (5e62468)
• docs: document configurations and examples (#​6449) (59430e0)
• docs: generate docs and examples (cdd77ec)
• email_routing: improved email routing sweepers (#​6429) (133c81e)
• iam: integrate generated changes for IAM resources (a87806e)
• include new sections for pr template (#​6395) (81c07e1)
• load_balancing: integrate generated changes for Load Balancing resources (4c6b34d)
• logpull_retention: add migration test for (#​6426) (529f313)
• logpull_retention: update acceptance test (#​6277) (3766b3f)
• logpush_job: add import tests for resource (#​6402) (cded8ec)
• logpush: integrate generated changes for Logpush resources (06e8446)
• notification_policy_webhook: add migration test for notification-policy-webhook (#​6443) (742d647)
• pages: integrate generated changes for Pages resources (64855ea)
• queue_consumer: testdata refactor (d301974)
• r2_bucket: v4 to v5 migration tests for cloudflare_r2_bucket (#​6437) (99ed1ee)
• sso_connector: add acceptance tests (#​6427) (8b54303)
• stainless: integrate changes from unpinned codegen version (9cb3b8e)
• test: acceptance tests for token validation resources (#​6417) (4d94bdd)
• test: add schema and token validation acceptance tests to CI (#​6421) (b805abc)
• test: increase legacy migrator test coverage (#​6401) (9a8c48a)
• universal_ssl_setting: add acceptance tests for universal_ssl_setting (2601c45)
• worker: integrate generated changes for Worker resources (1da2bf2)
• workers_kv_namespace: v4 to v5 migration tests for workers_kv_namespace (#​6424) (433010f)
• workers_kv: v4 to v5 migration tests for workers_kv (#​6435) (58ca912)
• workers_script: add workers scripts sweeper (#​6351) (f439a08)
• workers_script: fix resource name in TestAccCloudflareWorkerScript_ModuleWithDurableObject (614d8d3)
• workers_script: fix resource names in tests (788e73a)
• workers: integrate generated changes for Workers resources (ab0a330)
• zero_trust_access_service_token: add migration test for zero_trust_access_service_token (#​6416) (c77d5d5)
• zero_trust_gateway_policy: v4 to v5 migration for zero_trust_gateway_policy ([#&#8203

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.