Terraform-provider-cloudflare: Do not always need credentials.

[DingGGu]

Current Terraform version

Terraform v0.13.5
+ provider registry.terraform.io/cloudflare/cloudflare v2.12.0

Description

Currently, Using cloudflare providers needs credentials before using.
However, I don't think credential is required when using only cloudflare_ip_ranges.

It can visit https://api.cloudflare.com/client/v4/ips without credentials.
This API explained at https://api.cloudflare.com/#cloudflare-ips-properties

Use-cases

Potential Terraform configuration

# Copy-paste your Terraform configurations here.
provider "cloudflare" {
}

data "cloudflare_ip_ranges" "cloudflare" {}

terraform {
  required_version = ">= 0.13"
  required_providers {
    cloudflare = {
      source = "cloudflare/cloudflare"
      version = "~> 2.12.0"
    }
  }
}

References

https://api.cloudflare.com/#cloudflare-ips-properties

Community note

• Please vote on this issue by adding a 👍 reaction
  to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull
  request, please leave a comment

[jacobbednarz]

You're right that the endpoint doesn't require them however that endpoint is the exception and all other endpoints require authentication. From a usability stand point, the provider is better off requiring authentication across the board to avoid tripping people up on whether or not they need to set it given only one of all the API endpoints don't need it.

[kam1kaze]

I'm working on a terraform module where I need to get a list of Cloudflare IPs. Unfortunately, Cloudflare provider does not allow to do this without auth data :( So I make the following work-a-round:

data "http" "cloudflare_ips" {
  url = "https://api.cloudflare.com/client/v4/ips"
  request_headers = {
    Accept = "application/json"
  }
}
locals {
  cloudflare_ip_ranges = jsondecode(data.http.cloudflare_ips.body)
  whitelist_networks = join(",", concat(local.cloudflare_ip_ranges.result.ipv4_cidrs, local.cloudflare_ip_ranges.result.ipv6_cidrs))
}

[LordMike]

Can you at least update the docs to not say "optional" on all parameters - or at least describe somewhere that credentials _are_ required. ?

https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs

:)