cloudflare/tf-migrate

cloudflare/tf-migrate

Description: CLI tool for upgrading the terraform-provider-cloudflare to a new major version

Language: Go

License: Apache-2.0

Stars: 30

Forks: 7

Open issues: 4

Created: 2025-10-20T21:19:54Z

Pushed: 2026-05-12T19:38:09Z

Default branch: main

Fork: no

Archived: no

README:

tf-migrate - Cloudflare Terraform Provider Migration Tool

A CLI tool for automatically migrating Terraform configurations between different versions of the Cloudflare Terraform Provider. State migration is handled by the provider's built-in UpgradeState/MoveState mechanisms — tf-migrate only transforms config (.tf files).

Overview

tf-migrate helps you upgrade your Terraform infrastructure code by automatically transforming:

• Configuration files (.tf) — Updates resource types, attribute names, block structures, and generates import blocks for new v5 resources
• Provider version — Automatically updates required_providers to the latest v5 version and prints instructions to regenerate the lock file

> Note: tf-migrate does not modify Terraform state. State is upgraded automatically by the v5 provider on first terraform apply via its built-in UpgradeState/MoveState support.

Supported Migration Paths

| Source Version | Target Version | |----------------|----------------| | Cloudflare Provider v4 | Cloudflare Provider v5 |

Prerequisites

Minimum Provider Version (v4 → v5 only)

For v4 to v5 migrations, you must be running Cloudflare Provider v4.52.5 or higher before running tf-migrate. This version introduced critical state migration capabilities required for a successful upgrade.

The tool checks for this in the following order: 1. `.terraform.lock.hcl` — The installed provider version (most reliable) 2. `required_providers` block — The version constraint in your .tf files (fallback)

If neither is found, or if the version is below 4.52.5, the migration will be blocked with instructions on how to upgrade.

To bypass this check (e.g., for testing or CI), use --skip-version-check:

tf-migrate migrate --source-version v4 --target-version v5 --skip-version-check

Supported Resources (v4 → v5)

80+ resources with complete config migration support (click to expand)

| Product | v4 Resource Type | v5 Resource Type | Kind | |---------|-----------------|-----------------|------| | Accounts | cloudflare_account | cloudflare_account | resource | | | cloudflare_account_member | cloudflare_account_member | resource | | | data.cloudflare_account_roles | data.cloudflare_account_roles | data source | | | data.cloudflare_accounts | data.cloudflare_accounts | data source | | Addressing | cloudflare_byo_ip_prefix | cloudflare_byo_ip_prefix | resource ⚠ | | | cloudflare_regional_hostname | cloudflare_regional_hostname | resource | | | cloudflare_regional_tiered_cache | cloudflare_regional_tiered_cache | resource | | API Shield | cloudflare_api_shield | cloudflare_api_shield | resource | | | cloudflare_api_shield_operation | cloudflare_api_shield_operation | resource | | API Tokens | cloudflare_api_token | cloudflare_api_token | resource | | Argo | cloudflare_argo | cloudflare_argo_smart_routing / cloudflare_argo_tiered_caching | resource | | Bot Management | cloudflare_bot_management | cloudflare_bot_management | resource | | Cache | cloudflare_tiered_cache | cloudflare_tiered_cache | resource | | Certificate Packs | cloudflare_certificate_pack | cloudflare_certificate_pack | resource | | Custom Hostnames | cloudflare_custom_hostname | cloudflare_custom_hostname | resource | | | cloudflare_custom_hostname_fallback_origin | cloudflare_custom_hostname_fallback_origin | resource | | Custom Pages | cloudflare_custom_pages | cloudflare_custom_pages | resource | | Custom SSL | cloudflare_custom_ssl | cloudflare_custom_ssl | resource | | DNS | cloudflare_record | cloudflare_dns_record | resource | | | cloudflare_zone_dnssec | cloudflare_zone_dnssec | resource | | Healthchecks | cloudflare_healthcheck | cloudflare_healthcheck | resource | | IP Access Rules | cloudflare_access_rule | cloudflare_access_rule | resource | | Leaked Credentials | cloudflare_leaked_credential_check | cloudflare_leaked_credential_check | resource | | | cloudflare_leaked_credential_check_rule | cloudflare_leaked_credential_check_rule | resource | | Lists | cloudflare_list | cloudflare_list | resource ⚠ | | | cloudflare_list_item | merged into cloudflare_list | resource ⚠ | | Load Balancers | cloudflare_load_balancer | cloudflare_load_balancer | resource | | | cloudflare_load_balancer_monitor | cloudflare_load_balancer_monitor | resource | | | cloudflare_load_balancer_pool | cloudflare_load_balancer_pool | resource | | | data.cloudflare_load_balancer_pools | data.cloudflare_load_balancer_pools | data source | | Logpush | cloudflare_logpull_retention | cloudflare_logpull_retention | resource | | | cloudflare_logpush_job | cloudflare_logpush_job | resource | | | cloudflare_logpush_ownership_challenge | cloudflare_logpush_ownership_challenge | resource | | Managed Transforms | cloudflare_managed_headers | cloudflare_managed_transforms | resource | | mTLS | cloudflare_mtls_certificate | cloudflare_mtls_certificate | resource | | Notifications | cloudflare_notification_policy | cloudflare_notification_policy | resource | | | cloudflare_notification_policy_webhooks | cloudflare_notification_policy_webhooks | resource | | Observatory | cloudflare_observatory_scheduled_test | cloudflare_observatory_scheduled_test | resource | | Origin CA | cloudflare_origin_ca_certificate | cloudflare_origin_ca_certificate | resource | | Origin Pulls | cloudflare_authenticated_origin_pulls | cloudflare_authenticated_origin_pulls_settings (without hostname) / cloudflare_authenticated_origin_pulls (with hostname) | resource | | | cloudflare_authenticated_origin_pulls_certificate | cloudflare_authenticated_origin_pulls_certificate | resource | | Page Rules | cloudflare_page_rule | cloudflare_page_rule | resource | | Pages | cloudflare_pages_domain | cloudflare_pages_domain | resource | | | cloudflare_pages_project | cloudflare_pages_project | resource | | Queues | cloudflare_queue |…