Terraform apply is attempting to update read-only fileds [.modified_on]

[abdc-john]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

This an existing bug that was closed but never fixed #6076

This bug is still there and is very annoying, we have to keep destroying and recreating resource when making changes: Ignoring the fields does not work either

required_version = "~> 1.13.1"
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.12"
    }
  }

│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.www_settings_dns_record.cloudflare_dns_record.dns_record, provider "provider[\"registry.terraform.io/cloudflare/cloudflare\"]" produced an unexpected new
│ value: .modified_on: was cty.StringVal("2025-11-09T10:03:13Z"), but now cty.StringVal("2025-11-09T10:08:38Z").
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.

Affected resource(s)

• cloudflare_dns_record

Terraform configuration files

module "settings_dns_record" {
  source = "../../../modules/cloudflare/dns"

  zone_id = data.cloudflare_zone.org_com.zone_id
  name    = "settings"
  content = data.cloudflare_zone.org_com.name
  comment = "settings microservice"
  proxied = true
  tags    = []
}

resource "cloudflare_dns_record" "dns_record" {
  zone_id = var.zone_id
  name = var.name
  ttl = var.ttl
  type = var.record_type
  comment = var.comment
  content = var.content
  proxied = var.proxied
  settings = {
    flatten_cname = var.settings.flatten_cname
    ipv4_only = var.settings.ipv4_only
    ipv6_only = var.settings.ipv6_only
  }
  tags = var.tags

  lifecycle {
    ignore_changes = [
      comment_modified_on,
      created_on,
      modified_on,
      proxiable,
      tags_modified_on,
    ]
  }
}

Link to debug output

none

Panic output

No response

Expected output

should create or update in place the dns record

Actual output

│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.settings_dns_record.cloudflare_dns_record.dns_record, provider "provider[\"registry.terraform.io/cloudflare/cloudflare\"]" produced an unexpected new
│ value: .modified_on: was cty.StringVal("2025-11-09T10:03:13Z"), but now cty.StringVal("2025-11-09T10:08:38Z").
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.

Steps to reproduce

1. terraform init
2. terraform apply

Additional factoids

No response

References

No response

[KaydeeDee]

Hi there - This issue has been oddly stubborn and showing up across resources in an inconsistent way. I've assigned this to the central Terraform team to look into. Thank you for your patience as we look into fixing it.

[sonarlunar1983-dotcom]

Additional information

PROBLEM:
When adding a comment field to DNS records of type A and CNAME, an error occurs: "Provider produced inconsistent result after apply" with
message ".proxiable: was cty.True, but now cty.False".

FINDINGS:

1. Issue Terraform apply is attempting to update read-only fileds [.modified_on] #6438 (opened November 9, 2025) - describes exactly our problem:
   - Terraform attempts to update read-only field proxiable
   - User tried lifecycle ignore_changes for proxiable - did not help
   - Issue is active, assigned to Terraform team for investigation
2. Issue upgrade from 5.8.4 to 5.9.0 issues #6076 (closed, fixed in version 5.10.0):
   - Fixed issues with modified_on and comment_modified_on
   - Did NOT fix the proxiable issue
3. Provider source code analysis:
   - Field proxiable is correctly declared as Computed (read-only)
   - Provider code is correct, it attempts to preserve proxiable value from state
   - Problem is NOT in provider code

ROOT CAUSE:
CloudFlare API returns incorrect proxiable value after updating DNS record with added comment. When adding comment to a record, API
returns proxiable=false instead of proxiable=true, causing a mismatch error in Terraform.

WHAT DOESN'T WORK:

• lifecycle ignore_changes for proxiable - Terraform warns this field is computed, workaround doesn't help
• Upgrading to version 5.12.0 - bug still present
• terraform refresh - doesn't solve the problem
• retry apply - partially works for TXT, but not for A/CNAME

WHAT WORKS:

• TXT records - can use comment without issues (tested)
• A and CNAME records WITHOUT comment - work normally