Transform Rules configuration using Terraform

This page provides examples of creating Transform Rules in a zone using Terraform. The examples cover the following scenarios:

Create a URL rewrite rule
Create a request header transform rule
Create a response header transform rule
Configure Managed Transforms

If you are using the Cloudflare API, refer to the following resources:

Before you start

Obtain the necessary account or zone IDs

The Terraform configurations provided in this page need the zone ID (or account ID) of the zone/account where you will deploy rulesets.

To retrieve the list of accounts you have access to, including their IDs, use the List accounts operation.
To retrieve the list of zones you have access to, including their IDs, use the List zones operation.

Import or delete existing rulesets

Terraform assumes that it has complete control over account and zone rulesets. If you already have rulesets configured in your account or zone, do one of the following:

Import existing rulesets to Terraform using the cf-terraforming tool. Recent versions of the tool can generate resource definitions for existing rulesets and import their configuration to Terraform state.
Start from scratch by deleting existing rulesets (account and zone rulesets with "kind": "root" and "kind": "zone", respectively) and then defining your rulesets configuration in Terraform.

Create a URL rewrite rule

The following example creates a URL rewrite rule that rewrites requests for example.com/old-folder to example.com/new-folder:

Required API token permissions

All of the following token permissions are required:

Zone Transform Rules Write
Account Rulesets Read

Configure the cloudflare_ruleset ↗ resource:

resource "cloudflare_ruleset" "transform_url_rewrite" {
  zone_id     = var.cloudflare_zone_id
  name        = "Transform Rule performing a static URL rewrite"
  description = ""
  kind        = "zone"
  phase       = "http_request_transform"

  rules = [{
    ref         = "url_rewrite_old_folder"
    description = "Example URL rewrite rule"
    expression  = "(http.host eq \"example.com\" and http.request.uri.path eq \"/old-folder\")"
    action      = "rewrite"
    action_parameters = {
      uri = {
        path = {
          value = "/new-folder"
        }
      }
    }
  }]
}

resource "cloudflare_ruleset" "transform_url_rewrite" {
  zone_id     = "<ZONE_ID>"
  name        = "Transform Rule performing a static URL rewrite"
  description = ""
  kind        = "zone"
  phase       = "http_request_transform"

  rules {
    ref         = "url_rewrite_old_folder"
    description = "Example URL rewrite rule"
    expression  = "(http.host eq \"example.com\" and http.request.uri.path eq \"/old-folder\")"
    action      = "rewrite"
    action_parameters {
      uri {
        path {
          value = "/new-folder"
        }
      }
    }
  }
}

To create another URL rewrite rule, add a new rules object to the same cloudflare_ruleset resource.

Use the ref field to get stable rule IDs across updates when using Terraform. Adding this field prevents Terraform from recreating the rule on changes. For more information, refer to Troubleshooting.

For more information on rewriting URLs, refer to URL Rewrite Rules.

Create a request header transform rule

The following configuration example performs the following adjustments to HTTP request headers:

Adds a my-header-1 header to the request with a static value.
Adds a my-header-2 header to the request with a dynamic value defined by an expression.
Deletes the existing-header header from the request, if it exists.

Required API token permissions

All of the following token permissions are required:

Zone Transform Rules Write
Account Rulesets Read

Configure the cloudflare_ruleset ↗ resource:

resource "cloudflare_ruleset" "transform_modify_request_headers" {
  zone_id     = var.cloudflare_zone_id
  name        = "Transform Rule performing HTTP request header modifications"
  description = ""
  kind        = "zone"
  phase       = "http_request_late_transform"

  rules = [{
    ref         = "modify_request_headers"
    description = "Example request header transform rule"
    expression  = "true"
    action      = "rewrite"
    action_parameters = {
      headers = {
        "my-header-1" = {
          operation = "set"
          value     = "Fixed value"
        }
        "my-header-2" = {
          operation  = "set"
          expression = "cf.zone.name"
        }
        "existing-header" = {
          operation = "remove"
        }
      }
    }
  }]
}

resource "cloudflare_ruleset" "transform_modify_request_headers" {
  zone_id     = "<ZONE_ID>"
  name        = "Transform Rule performing HTTP request header modifications"
  description = ""
  kind        = "zone"
  phase       = "http_request_late_transform"

  rules {
    ref         = "modify_request_headers"
    description = "Example request header transform rule"
    expression  = "true"
    action      = "rewrite"
    action_parameters {
      headers {
        name      = "my-header-1"
        operation = "set"
        value     = "Fixed value"
      }
      headers {
        name       = "my-header-2"
        operation  = "set"
        expression =