Terraform-provider-cloudflare: Add Transform Rule resources

[quinlanj]

Current Terraform version

Terraform v0.14.3

• provider registry.terraform.io/cloudflare/cloudflare v2.19.2

Description

Cloudflare recently released Transform Rules, and it would be great if we could make Transform Rule resources the way we can currently make Page Rule resources in terraform.

Use cases

Codify everything I can create in the 'Transform Rules' section of the UI into terraform

Potential Terraform configuration

Analogous to page rules, so something like this:

resource "cloudflare_transform_rule" "foobar" {
  # The DNS zone ID to which the transform rule should be added.
  zone_id = var.cloudflare_zone_id

  # Whether the transform rule is active or disabled.
  status = "active" 

  # The priority of the transform rule among others for this target
  priority = 1 

  # a descriptive name
  name = 'test rule'

  # an expression denoting which incoming requests to target
  # An expression is either:
  #   A base expression containing field, operator and value properties
  #   A compound expression containing operator, operand_a and operand_b properties
  #       operand_a and operand_b must contain a valid expression
  target {
    operator = 'AND'
    operand_a {
      field = 'hostname'
      operator = 'equals'
      value = 'foo.bar.com'
    }
    operand_b {
      field = 'cookie'
      operator = 'contains'
      value = 'blah'
    }
  }

  # rewrite actions taken by the transform rule
  rewrite {
    path {
      preserve = true
    }
    query {
      rewrite {
        dynamic = "regex_replace(http.request.uri.path, "^/([^/]*)/(.*)$", "/${2}") "
      }
    }
  }
}

References

_No response_

[MrMickS]

Is there any news on this. It is something that we are interested in using.

[jacobbednarz]

There hasn't been anything directly targeting Transformation Rules however a large part of the support for it will work by proxy very soon (cloudflare/cloudflare-go already has support if you want to play with the Golang SDK). We are making the move to an approach called Rulesets which is a new concept that abstracts away the product configuration into a reusable syntax which can be across the board.

I'm in the process of adding support for the V2 WAF at the moment via #1143 however once that lands, _most*_ of the functionality will be possible if you get the configuration right. For instance, merging that change will allow Magic Transit, Transformation Rules, Custom Firewall Rulesets, Managed Rulesets and Rate Limiting to largely work as is.

Word of caution though, until it's documented please do not consider it production ready as your mileage may vary greatly depending on your account and entitlements that are provisioned. If in doubt, trial it on a non-production domain or get in touch with your Cloudflare Account team to discuss the suitability.

---

_*where most is standard configurations. some more exotic setups definitely not covered_

[casertap]

Please @jacobbednarz can you give us an idea of the timeline to have terraform-cloudflare proxying cloudflare-go to allow creating transformation rules?
Thanks for all the good work!
Cheers

[jacobbednarz]

As promised, v2.26.0 released earlier today landed Rulesets support targetting the v2 WAF. I managed to grab an hour free this afternoon and also pushed up #1169 which adds support for Transformation Rules to the master branch. You're free to pull it locally (with the cloudflare-go patch) and kick the tyres in the meantime.