repository·master·Indexed 41 days ago
https://github.com/pulumi/pulumi-cloudflareManage Cloudflare resources, such as DNS records and rulesets, using Infrastructure as Code in TypeScript, Python, Go, .NET, and Java. This provider is a derived work of the Cloudflare Terraform provider and supports authentication via API Tokens, API Keys, or User Service Keys.
pulumi-cloudflare package allows you to create and manage Cloudflare cloud resources using Pulumi's Infrastructure as Code (IaC) capabilities. It is a derived work of the Cloudflare Terraform provider, providing access to Cloudflare's extensive API surface through Pulumi's programming models in .NET, Python, Go, TypeScript, and Java.The Cloudflare provider is available as a package for all supported Pulumi languages. Choose the package corresponding to your runtime:
@pulumi/cloudflarepulumi-cloudflaregithub.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflarePulumi.Cloudflarecom.pulumi/cloudflareInstall the Cloudflare provider package using the package manager corresponding to your programming language. Ensure you have the Pulumi CLI installed first.
### Node.js (Java/TypeScript)
$ npm install @pulumi/cloudflare
# or
$ yarn add @pulumi/cloudflare
### Python
$ pip install pulumi_cloudflare
### Go
$ go get github.com/pulumi/pulumi-cloudflare/sdk/v6
### .NET
$ dotnet add package Pulumi.CloudflareThe release of version 1.0.0 introduced several breaking changes to provider configuration and environment variables. If you are upgrading from a version prior to 1.0.0, you must apply the following changes:
### BREAKING CHANGES (v1.0.0):
* provider configuration option `token` has been renamed to `api_key`.
* provider configuration option `org_id` has been renamed to `account_id` and is now required.
* provider configuration option `use_org_from_zone` has been removed.
* environment variable `CLOUDFLARE_TOKEN` has been renamed to `CLOUDFLARE_API_TOKEN`.
* environment variable `CLOUDFLARE_ORG_ID` has been renamed to `CLOUDFLARE_ACCOUNT_ID`.
* environment variable `CLOUDFLARE_ORG_ZONE` has been removed.
* `zone_id` is now a required parameter in all resourcesIn version 2.7.0 and later, the provider includes improved preview functionality that provides a more accurate understanding of actual changes. If you need to revert to the previous behavior, you can disable this feature by setting the PULUMI_DISABLE_PROVIDER_PREVIEW environment variable to 1 or false.
export PULUMI_DISABLE_PROVIDER_PREVIEW=1The Cloudflare provider requires authentication to perform operations. You can provide credentials via Pulumi configuration or environment variables.
Important Authentication Rules:
cloudflare:apiKey, cloudflare:apiToken, or cloudflare:apiUserServiceKey.cloudflare:apiKey, you must also provide cloudflare:email.cloudflare:apiToken is the recommended modern method; cloudflare:apiKey is considered legacy.| Config Key | Env Var | Description |
|---|---|---|
cloudflare:apiKey | CLOUDFLARE_API_KEY | Legacy API key. Requires cloudflare:email. |
cloudflare:apiToken | CLOUDFLARE_API_TOKEN | Recommended API Token. |
cloudflare:apiUserServiceKey | CLOUDFLARE_API_USER_SERVICE_KEY | Restricted key for specific endpoints. |
cloudflare:email | CLOUDFLARE_EMAIL | Required when using apiKey. |
The Cloudflare provider requires authentication to interact with Cloudflare resources. You must provide exactly one of the following authentication methods. You can set these via Pulumi configuration or environment variables.
apiToken (Recommended): The API Token for operations. Use the CLOUDFLARE_API_TOKEN environment variable or set via Pulumi config.apiKey: The legacy API key. Requires the email field to be set. Use the CLOUDFLARE_API_KEY environment variable.apiUserServiceKey: A special restricted API key. Use the CLOUDFLARE_API_USER_SERVICE_KEY environment variable.To set the apiToken using Pulumi configuration, add the following to your Pulumi.yaml:
config:
cloudflare:apiToken:
value: 'YOUR_API_TOKEN'config:
cloudflare:apiToken:
value: 'TODO: var.cloudflare_api_token'Use the following configuration keys to customize the HTTP client behavior for the Cloudflare provider.
| Config Key | Env Var | Type | Description |
|---|---|---|---|
cloudflare:baseUrl | CLOUDFLARE_BASE_URL | String | Overrides the default HTTP client base URL. |
cloudflare:userAgentOperatorSuffix | CLOUDFLARE_USER_AGENT_OPERATOR_SUFFIX | String | Appends a value to the HTTP User Agent. Defaults to pulumi/<version>. Use an empty string to remove the Pulumi identifier. |
The Cloudflare provider uses specific logic to compute resource IDs, often delegating to internal fields to ensure consistency with Cloudflare's API.
Some resources use specific fields as their primary Pulumi ID:
cloudflare_ai_search_instance: Uses aiSearchInstanceId.cloudflare_image: Uses imageId.cloudflare_zero_trust_access_ai_controls_mcp_portal: Uses zeroTrustAccessAiControlsMcpPortalId.cloudflare_zero_trust_access_ai_controls_mcp_server: Uses zeroTrustAccessAiControlsMcpServerId.cloudflare_zone_setting: Uses settingId.cloudflare_snippet: Uses snippetName.For resources where the ID is not explicitly provided by the API, the provider attempts to construct it using available context, such as combining accountId and zoneId.
The Cloudflare provider includes PreStateUpgradeHook and TransformFromState logic to handle migrations from version 5 to version 6. If you are upgrading your stack, the following resources have specific schema transformations applied automatically:
cloudflare_ruleset: Migrates actionParameters.headers from an array to a MapNestedAttribute and updates actionParameters.rules from a map[string]string to a map[string][]string.cloudflare_list: Flattens the v5 value wrapper (containing asn, ip, hostnames, redirects) into top-level fields (asn, ip, hostname, redirect).cloudflare_zone: Transforms zone to name, accountId to account.id, and plan to plan.id.cloudflare_zero_trust_access_application: Migrates cors_headers from a list to an object and policies from a list of strings to a list of objects containing id.cloudflare_zero_trust_access_policy: Migrates boolean and string properties into nested objects (e.g., includes.certificate becomes an object).cloudflare_workers_route: Ensures the id field is populated from the pattern field if id is missing.You can manage Cloudflare DNS records using the DnsRecord resource. Below are examples for various languages.
import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";
// Create a DNS record
const www = new cloudflare.DnsRecord("www", {});