Terraform Cloudflare Provider v5.28.1: Go 1.27.3 Security Rebuild and SDK Cleanup

Introduction

Cloudflare has shipped v5.28.1 of the cloudflare/terraform-provider-cloudflare provider. This is a maintenance release focused on a build-chain security fix and an SDK dependency update, with no HCL schema changes reported in the release notes.

What Is New

Go 1.27.3 build: distrust of revoked intermediate CAs

The provider binary is now compiled with Go 1.27.3. This Go release embeds a distrust list for a set of intermediate certificate authorities that have been revoked due to CA compromise. Because the list is compiled directly into the provider binary, TLS chains signed by those revoked intermediates are rejected by the provider regardless of what the host machine's system trust store says.

No configuration changes are required to benefit from this. If your Terraform runner (CI agent, local workstation, Terraform Cloud/Enterprise worker) happens to validate Cloudflare API TLS connections through one of the now-distrusted intermediates, upgrading is the only way to pick up the fix.

cloudflare-go SDK updated to v7.13.1

The underlying Go SDK dependency, cloudflare-go, moves to v7.13.1.

Removal of the unused cloudflare-go v6 SDK

The provider previously carried an unused v6 copy of the cloudflare-go SDK alongside v7. That dependency has been removed. As part of this cleanup, the cloudflare_api_shield_discovery_operation list data source, which was still wired to the v6 SDK internally, now uses v7. This is an internal implementation change — the release notes do not report any schema or attribute changes for this data source.

# No HCL changes required for this release.
# Existing usage of the data source is unaffected:
data "cloudflare_api_shield_discovery_operation" "example" {
 zone_id = var.cloudflare_zone_id
}

Upgrade Steps

Pin the provider to the new patch version in your configuration:

terraform {
 required_providers {
 cloudflare = {
 source = "cloudflare/cloudflare"
 version = "~> 5.28.1"
 }
 }
}

Re-initialize to pull the updated provider binary:

terraform init -upgrade

Since this is the first tracked version for this provider in this workflow, there are no prior-version migration notes to apply — treat this as a baseline install/upgrade.

Verify

Confirm the provider version resolved by Terraform matches v5.28.1:

terraform providers

or, for a lockfile-level check:

grep -A2 'cloudflare/cloudflare' .terraform.lock.hcl

Run a plan to confirm no unexpected diffs are introduced by the upgrade:

terraform plan

Conclusion

v5.28.1 is a low-risk, recommended upgrade: it tightens TLS trust by rejecting chains through revoked intermediate CAs at the binary level, and cleans up a redundant SDK dependency. No HCL migration is needed. Full details are on the release page.