Skip to main content

​
🌐 Managing Cloudflare DNS with Terraform

ZONE_ID="" API_TOKEN=""

​
tf vars file for token

cloudflare_api_token = "" cloudflare_zone_id = ""

​
Using Azure Blob Storage for State Backend

terraform init -migrate-state export ARM_ACCESS_KEY="" This repository automates the management of Cloudflare DNS records using Terraform.
It includes scripts to import existing DNS records, generate Terraform configurations, and apply changes efficiently.

​
📂 Directory Structure

.
├── account-personal/          # Contains different accounts/domains
│   ├── ahmadraza.in/         # Terraform configs for ahmadraza.in
│   ├── kubecloud.in.net/     # Terraform configs for kubecloud.in.net
│   └── users/                # Other Cloudflare-related user settings
├── cf-terraforming/           # Terraforming scripts for Cloudflare
├── import.sh                  # Script to import existing DNS records into Terraform state
├── import.tf                  # Terraform resource blocks generated from Cloudflare records
├── main.tf                    # Main Terraform configuration
├── output.tf                  # Terraform outputs
├── provider.tf                 # Cloudflare provider configuration
├── README.md                   # Documentation (You're reading it!)
├── secret.md                   # Stores API keys and sensitive information (DO NOT SHARE!)
├── terraform.tfstate            # Terraform state file (tracks deployed resources)
├── terraform.tfstate.backup     # Backup of Terraform state
├── terraform.tfvars             # Terraform variables
├── tf-gen.sh                    # Script to generate Terraform resource blocks
└── variables.tf                 # Variable definitions for Terraform

​
🛠️ Setup Requirements

To use this Terraform setup for managing Cloudflare DNS, you need:

​
1️⃣ Cloudflare API Token

Generate an API token with the following permissions:
  • Zone.Zone Read
  • Zone.DNS Read & Write
💡 How to generate API Token:
  1. Go to Cloudflare Dashboard
  2. Navigate to My Profile > API Tokens
  3. Create a custom token with the above permissions
  4. Copy and save the token securely (you’ll need it for Terraform)

​
2️⃣ Cloudflare Zone ID

Each Cloudflare domain (zone) has a unique Zone ID. 💡 How to find your Zone ID:
  1. Go to Cloudflare Dashboard
  2. Select your domain
  3. Under Overview, find the Zone ID at the bottom of the page.

​
🚀 Step-by-Step Usage

​
1️⃣ Configure Terraform Provider

Edit the provider.tf file with your API token: 
provider "cloudflare" {
  api_token = "your-cloudflare-api-token"
}
Alternatively, set it as an environment variable: 
export CLOUDFLARE_API_TOKEN="your-cloudflare-api-token"

​
2️⃣ Generate Terraform Resource Blocks

Use the tf-gen.sh script to fetch existing Cloudflare DNS records and create Terraform configuration: 
bash tf-gen.sh
This will generate import.tf containing Terraform resource blocks for each DNS record.

​
3️⃣ Import Existing Cloudflare DNS Records

Run the import.sh script to import existing records into Terraform state: 
bash import.sh
This prevents Terraform from trying to recreate records that already exist.

​
4️⃣ Apply Terraform Configuration

After importing, run Terraform to verify and apply changes: 
terraform init
terraform plan
terraform apply

​
🔄 Handling DNS Record Changes

  • To add new records: Modify main.tf and run terraform apply.
  • To update existing records: Change main.tf and run terraform plan to preview changes.
  • To remove records: Delete the record from main.tf and run terraform apply.

​
🔥 Troubleshooting

​
🛑 Terraform is trying to recreate existing records

If terraform plan shows it will recreate existing records, it’s likely because:
  • The import was not done correctly
  • The imported state differs from the generated Terraform code
✅ Solution: Ensure you run import.sh before terraform plan.

​
📜 Example Terraform Configuration

A typical DNS record managed with Terraform looks like this: 
resource "cloudflare_dns_record" "example" {
  zone_id = "947884535b3bc67c60b37af84c91a744"
  name    = "example"
  type    = "A"
  content = "198.51.100.4"
  proxied = true
  ttl     = 1
}

​
🎯 Next Steps

  • Automate DNS updates using CI/CD
  • Manage multiple Cloudflare accounts using workspaces
  • Enhance security by using environment variables for sensitive data

​
👤 Author

Ahmad Raza - ahmadraza.in
For more guides, visit: docs.ahmadraza.in 🚀

​
📌 What This README Covers

✔️ Terraform setup for Cloudflare DNS
✔️ Generating Terraform configuration from existing records
✔️ Importing existing DNS records into Terraform state
✔️ Managing DNS records efficiently
✔️ Troubleshooting common issues