Cloudflare Terraform Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A zone is a name you already control

Cloudflare in this window is a zone you administer. The generators draft a DNS record, a custom rule, or a redirect. They do not change the zone. example.com in a sample is documentation. You substitute a name you control, or you do not apply the draft.

A DNS change can take the name away from the current target. Write the current target before you draft the new one. The rollback is that current value. A second admin on the account remains able to sign in, because a rule can lock the person who wrote it.

A custom rule is a sentence you can explain: which hostname, which path, which action. An action you cannot explain does not go in the file. This page is not a way to study how to get around someone else's rule. You only draft a rule for the zone in the ticket.

The token that can edit the zone is scoped to that zone and stored in the secret store. A global token in a Terraform file is the mistake. prompt-for-this marks the gap. Redirects are a separate draft. You do not ship a record, a rule, and a redirect in one apply.

One record or one rule, and the previous value

Pick one change: a lab record, or a rule, or a redirect. Draft only that one. Read the hostname. If it is not yours, stop. Write the previous value beside the draft.

If you chose a rule, read the action aloud. Block, challenge, or skip must match a reason in the ticket. A rule that matches every request is a lockout. Narrow it until a second person can say which requests it hits.

If you chose a redirect, write the source and the destination. Both are names you mean. A redirect loop is two lines you can see in the draft if you read them together. Read them together.

The storage and network guides own the origin behind the name. This page does not open a bucket or a security group. The token stays out of git. Apply waits until the previous value is written down.

# Cloudflare note. One zone you administer.
# example.com is not your zone.
# Write the previous DNS value before you change it.
# A rule must not match every request.
# The token is scoped and is not in the file.
# prompt-for-this is not a token.

A change you can finish

The later change applies one draft, in the zone you named, with the previous value already stored.

Rollback is putting that previous value back, or disabling the one rule. A second admin can do it if the rule was wider than you thought.

Name the zone and confirm you administer it.
Choose one of record, rule, or redirect.
Write the previous value or the current behaviour.
Draft that one object and read the hostname.
Narrow a rule until it cannot match everything.
Keep the token out of the file.
Leave apply for a window with a second admin available.

Mistakes that outlive the command

Cloudflare fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A draft applied to a zone you do not control.
example.com left as the name you apply.
No previous DNS value written down.
A rule that matches every request.
A record, a rule, and a redirect in one apply.
A global token in the Terraform file.
Studying how to bypass a rule on someone else's zone.
A redirect whose destination you did not read.
Locking out the only admin.
A secret in the ticket.

Decisions to write down before the window

One decision for Cloudflare: The zone is yours. One object is in the draft. The hostname is yours, not example.com. The previous value is written. A rule is narrow. The token is scoped to the zone. The token is not in git. A second admin can sign in. Apply is later. Origin changes belong to other guides. One change is this window. And a second person can say what the draft does.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for Cloudflare. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. Cloudflare is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Cloudflare checks before a zone change

Confirm this before you call the change done: The zone name is in the ticket. You administer that zone. The previous value is recorded. The draft contains one object. The hostname is not example.com. A rule does not match every request. No token is in the file. A second admin is named. Nothing was applied in the writing hour. The note has no bypass instructions. Rollback is the previous value. The next window is that one object. The hostname in the prompt matches the hostname in the ticket for Cloudflare. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for Cloudflare happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.