Unable to create custom log resource rule

[james-callahan]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

I'm trying to create a "custom log field" (https://developers.cloudflare.com/logs/reference/custom-fields/) with the v5 provider

Affected resource(s)

cloudflare_ruleset

Terraform configuration files

resource "cloudflare_ruleset" "log_traces" {
  # Note: can only be enabled on enterprise zones
  zone_id     = cloudflare_zone.mydomain.id
  name        = "log trace data"
  description = "logs (existing) b3 header for tracing. Note that cloudflare only send the value pre-transform"
  kind        = "zone"
  phase       = "http_log_custom_fields"

  rules = [{
    action = "log_custom_field"
    action_parameters = {
      request_fields = [
        { name = "b3" },
      ]
    }

    expression  = "true"
    description = "b3 header"
    enabled     = true
  }]
}

Link to debug output

no

Panic output

No response

Expected output

success

Actual output

400 Bad Request {
│ "result": null,
│ "success": false,
│ "errors": [
│ {
│ "code": 20217,
│ "message": "'zone' is not a valid value for kind because exceeded maximum number of zone rulesets for phase http_log_custom_fields",
│ "source": {
│ "pointer": "/kind"
│ }
│ }
│ ],
│ "messages": []
│ }
│

Steps to reproduce

.

Additional factoids

This previously worked in v4. (via #1630) (I've migrated to the new schema for the resource in my example above though)

References

No response

[KaydeeDee]

Hi there - which version of v5 on you on? It helps us pinpoint the issue.

[james-callahan]

Hi there - which version of v5 on you on? It helps us pinpoint the issue.

Currently on 5.11.0

[KaydeeDee]

I've created a ticket for the team to investigate - thank you for submitting an issue!

[MisterOwlPT]

Hi!

I want to report that I am also finding the same error when creating a custom firewall rule.

Using cf-terraforming I managed to work around the error but I’m not sure whether this is the intended solution, so I wanted to add my findings here.

Terraform and Cloudflare provider version

• Terraform: v1.13.4
• Cloudflare provider: 5.13.0

I am working on a linux_amd64 machine.

Terraform configuration files

resource "cloudflare_ruleset" "default_ruleset" {

  zone_id = var.cloudflare_zone_id
  kind    = "zone"
  name    = "default_ruleset"
  phase   = "http_request_firewall_custom"
  rules = [
  {
      action       = "block"
      description  = "Block all incoming requests from outside of Portugal"
      enabled      = true
      expression   = "(not ip.src.country in {\"PT\"})"
    }
  ]

}

Panic output

╷ 
│ POST "https://api.cloudflare.com/client/v4/zones/<REDACTED>/rulesets": 400 Bad Request {
│   "result": null,
│   "success": false,
│   "errors": [
│     {
│       "code": 20217,
│       "message": "'zone' is not a valid value for kind because exceeded maximum number of zone rulesets for phase http_request_firewall_custom",
│       "source": {
│         "pointer": "/kind"
│       }
│     }
│   ],
│   "messages": []
│ }
│

Steps to reproduce

Additional factoids

As per the guide linked above, I created the desired ruleset manually on the Cloudflare dashboard and then generated a Terraform configuration using cf-terraforming.

I then imported said configuration into my existing Terraform state and was able to both updating and deleting the ruleset.
It appears that just the creation is not working.

The major difference between the configuration generated by cf-terraforming and the one I've used seems to be the name of the Terraform resource (terraform_managed_resource_<REDACTED>_0).
I've removed all other extra fields from the rule and everything is still working as intended.

Here's the output configuration from cf-terraforming for my use-case:

resource "cloudflare_ruleset" "terraform_managed_resource_<REDACTED>_0" {
  kind    = "zone"
  name    = "default"
  phase   = "http_request_firewall_custom"
  zone_id = "<REDACTED>"
  rules = [{
    action       = "block"
    description  = "Block all incoming requests outside of Great Britain"
    enabled      = true
    expression   = "(not ip.src.country in {\"PT\"})"
    id           = null
    last_updated = "2025-12-01T21:46:35.578167Z"
    ref          = "..."
    version      = "1"
  }]
}