Infrastructure as Code with Terraform

4/13/2026

This post introduces a significant evolution in Cloudflare's IaC strategy by announcing the rebuilding of the Wrangler CLI to become a unified interface for all Cloudflare products. It introduces a new TypeScript schema for defining APIs, CLI commands, and bindings, enabling code generation for multiple interfaces including the CLI, SDKs, Terraform, and documentation. The post also announces 'Local Explorer,' a new feature for local development that mirrors the Cloudflare API for simulated resources, enhancing agent-based development workflows.

12/19/2025

This post introduces the 'Code Orange: Fail Small' initiative, a comprehensive plan to enhance network resilience following recent major outages. It directly extends the Infrastructure as Code theme by proposing to apply the same controlled rollout and Health Mediated Deployment (HMD) principles used for software releases to configuration changes. This includes requiring controlled rollouts for all configuration changes, reviewing and improving failure modes between critical services, and overhauling 'break glass' procedures for faster incident resolution. The post highlights the critical need to treat configuration changes with the same rigor as code deployments to prevent future widespread incidents.

12/9/2025

This post details Cloudflare's internal adoption of Infrastructure as Code (IaC) for managing its own platform, focusing on the 'shift left' principle for security and consistency across hundreds of internal production accounts. It highlights the use of Terraform, Atlantis, GitLab, and a custom state file manager (tfstate-butler). A key contribution is the implementation of Policy as Code using Open Policy Agent (OPA) and Rego to define and enforce security baselines, including handling exceptions. The post also shares lessons learned regarding onboarding, configuration drift, and the importance of automation, particularly the use of cf-terraforming for migrating existing resources.

11/13/2025

This post details the critical role of configuration management tools like Salt in maintaining Cloudflare's IaC-driven infrastructure. It explains how Salt failures can cause release delays and introduces the development of a self-service system to diagnose and resolve these failures by correlating them with git commits, external service failures, and ad hoc releases. This enhances the overall integrity, traceability, and efficiency of infrastructure management.

4/2/2025

This post details a complex debugging scenario encountered while setting up a local development environment for the Backstage project. The author describes a persistent 27-second timeout error with `yarn test` on a Linux system, which was not present on macOS. Through extensive troubleshooting, including shell history analysis, Jest flag experimentation, and the use of `strace`, the author identified the issue as a system-level timeout related to `epoll_wait` and `SIGCHLD` signals, potentially linked to filesystem watchers or process management. The post emphasizes the importance of detailed system-level analysis and collaborative debugging in resolving intricate development environment issues, which indirectly supports the broader theme of robust infrastructure management and development practices.

9/24/2024

This post details the automation of the Cloudflare Terraform provider generation directly from OpenAPI schemas. This eliminates manual maintenance, ensures immediate availability of new features and attributes, and improves the quality and coverage of the provider. It also covers the migration from terraform-plugin-sdk to terraform-plugin-framework for better handling of null/unset values and improved developer experience.

11/17/2022

This post details Cloudflare's internal adoption and best practices for using the Cloudflare Terraform provider. It covers the rationale for using Terraform (consistency, auditability, self-service), its integration into CI/CD pipelines with Atlantis for automated plans and applies, the architecture of their monorepo with per-account state files, encrypted state management, daily state reconciliation for drift detection, and the introduction of API/Terraform read-only mode for Zero Trust configurations to enforce a single source of truth. It also provides code snippets for managing account memberships and recommendations for resource definition.

5/14/2021

This post details how to automate the creation and management of Cloudflare Tunnels using Terraform. It introduces Named Tunnels and their API, enabling programmatic tunnel creation and credential management. The post provides a practical example of configuring a GCP instance with a startup script that dynamically generates tunnel credentials and configuration files, integrating with Cloudflare Tunnel's ingress rules and Cloudflare Access for Zero Trust policies. It highlights the benefits of IaC for tunnel management, including auto-scaling, dynamic resource provisioning, and CI/CD pipeline integration.

4/17/2021

Introduced a new version of `cf-terraforming` that leverages `terraform-exec` and the provider's JSON schema to auto-generate Terraform configuration, significantly reducing manual effort and improving maintainability. The tool now outputs `terraform import` commands instead of generating tfstate directly, further simplifying its maintenance and decoupling it from Terraform's internal state management. This addresses challenges related to duplication of effort when resources change and the impact of Terraform updates on the bootstrapping tool.

10/9/2019

This post details Workable's journey in adopting Infrastructure as Code (IaC) for managing Cloudflare configurations using Terraform and Terragrunt. It explores different approaches to structuring Terraform code, including static, parametrized, and dynamic resource management, with specific examples for access rules, zone settings, account members, and rate limits. The post highlights the challenges and trade-offs encountered in creating a modular and DRY setup, such as handling multiple organizations, state files, and dynamic URL patterns in rate limiting.

2/15/2019

Introduced `cf-terraforming`, an open-source utility to migrate existing Cloudflare configurations (defined via dashboard and API) into Terraform-compliant configuration files. This tool supports exporting individual resources or all resources, and is compatible with all resource types managed by the official Cloudflare Terraform provider.

9/13/2018

This post introduces the integration of Cloudflare Workers with the Cloudflare Terraform Provider, enabling users to manage Workers scripts and routes declaratively. It provides a step-by-step guide on setting up Terraform configuration, defining worker scripts using `cloudflare_worker_script` resource, and configuring routes with `cloudflare_worker_route` resource. It also covers prerequisites, credential management, and the process of importing existing workers.

4/30/2018

This post extends the Terraform management of Cloudflare configurations by introducing the management of load balancing, page rules, and reviewing/rolling back configurations. It details the creation of health checks, origin pools, and load balancers using Terraform resources, and demonstrates how to add a second DNS record for load balancing purposes. It also covers the process of previewing and applying changes using `terraform plan` and `terraform apply`, and verifying the applied configurations.

4/27/2018

This post introduces the use of Terraform for managing Cloudflare configurations, specifically detailing how to set up the Cloudflare provider, define DNS records, and apply changes. It highlights the benefits of using Terraform for configuration management, including source code control, change management, and version tracking. It also covers the installation of Terraform and the Cloudflare provider, and demonstrates basic usage with a 'Hello, world!' example and the creation of an 'A' record. The post also touches on using environment variables for authentication and the importance of reviewing execution plans before applying changes.

12/14/2016

This post introduces the Cloudflare Salt module, enabling the management of Cloudflare DNS records using SaltStack. This allows for DNS records to be treated as configuration, providing a single source of truth, peer-reviewed and versioned changes, and making these capabilities available to customers. The module supports managing zone records with authentication details and record configurations, with plans to extend Salt management to other Cloudflare settings like WAF, caching, and page rules.