cloudflare_zone_setting missing setting to enable Universal SSL (5.x breaking change)

[nslusher-sf]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.5.7
on darwin_arm64

Cloudflare provider 5.5.0

Affected resource(s)

cloudflare_zone_setting

Terraform configuration files

N/A

Link to debug output

N/A

Panic output

No response

Expected output

N/A

Actual output

N/A

Steps to reproduce

In the 4.x provider you could enable Universal SSL on a zone like this:

resource "cloudflare_zone_settings_override" "this" {
  zone_id = cloudflare_zone.this.id

  settings {
    universal_ssl    = "on"
  }
}

In the 5.x provider this setting appears to be missing from the new cloudflare_zone_setting resource. Has this setting been removed? If so, can the documentation be updated and list this as a breaking change?

Additional factoids

No response

References

No response

[parmeet12singh]

@nslusher-sf

They've moved the universal_ssl setting as per the API docs.

The universal_ssl setting available in the following API -

curl --location 'https://api.cloudflare.com/client/v4/zones/:zone-id/ssl/universal/settings' \
--header 'X-Auth-Key: <key>' \
--header 'X-Auth-Email: <email-id>'

Even, I'm trying to find what cloudflare terraform resource handles the universal_ssl setting.

[jblinkedin]

Hilariously this kinda works, in as much as it makes the necessary change, but returns an error after.

Seems the cloudflare_zone_setting can be abused to make abitrary API calls. Score another win for V5

TF

resource "cloudflare_zone_setting" "universal_ssl" {
  zone_id = cloudflare_zone.this.id
  setting_id = "../ssl/universal/settings"
  # docs hint: https://developers.cloudflare.com/api/node/resources/ssl/subresources/universal/subresources/settings/
  value = {} # "enabled": "off" }
  enabled = false 
}

output:

╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to cloudflare_zone_setting.universal_ssl, provider "provider[\"registry.terraform.io/cloudflare/cloudflare\"]" produced an unexpected new value: .editable: was cty.True, but now null.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.

[nslusher-sf]

@KaydeeDee Any updates on this? This appears to be a regression from the 4.x provider.

[parmeet12singh]

@jhutchings1 @KaydeeDee - Any update on this issue?

[jhutchings1]

@parmeet12singh There has been some progress on this one over the past couple of weeks. I'm not sure it'll be in the next release, but I'm hopeful! 🤞🏻

[yan12125]

I'm not sure it'll be in the next release, but I'm hopeful! 🤞🏻

Seems like it is? #6397

[KaydeeDee]

This should be going out int he next release everyone! We're working on that today, but it may go out on Monday if we run into any bumps.