# cloudflare/terraform-provider-cloudflare architecture

> Architecture diagram of the GitHub repository cloudflare/terraform-provider-cloudflare, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cloudflare/terraform-provider-cloudflare
- Repository: https://github.com/cloudflare/terraform-provider-cloudflare

## Overview

This is a Terraform provider that exposes Cloudflare REST API capabilities as Terraform resources and data sources. The principal workflow is Terraform configuration reaching the provider plugin, which registers service implementations that manage Cloudflare objects and return state to Terraform. The tree shows broad service coverage, including account, security, AI, certificate, and connectivity features. The sampled provider code confirms provider construction and resource registration; README documentation establishes the REST API role. Individual service request wiring was not sampled, so service-to-API links reflect the documented product contract, not inspected call sites.

Main entry points: [`internal/provider.go`](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/provider.go) (Provider setup), [`main.go`](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/main.go) (Plugin entry), [`internal/services/account/resource.go`](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/account/resource.go) (Account resources), [`internal/services/access_rule/resource.go`](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/access_rule/resource.go) (Access rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Provider runtime"]
  node_plugin_entry["Plugin entry<br/>[main.go]"]
  node_provider["Provider setup<br/>[provider.go]"]
end

subgraph group_account_security["Account security"]
  node_account_service["Account resources<br/>[resource.go]"]
  node_access_rule["Access rules<br/>[resource.go]"]
  node_access_group["Access groups"]
  node_api_shield["API Shield<br/>[resource.go]"]
  node_content_scanning["Content scanning<br/>[resource.go]"]
end

subgraph group_platform_services["Platform services"]
  node_certificate["Certificates<br/>[resource.go]"]
  node_connectivity["Connectivity directory<br/>[resource.go]"]
  node_ai_gateway["AI Gateway<br/>[resource.go]"]
  node_ai_search["AI Search<br/>[resource.go]"]
  node_worker_validation["Worker validation"]
end

subgraph group_internal_types["Internal representation"]
  node_json_codec["API JSON codec<br/>[decoder.go]"]
  node_custom_json_codec["Custom JSON codec<br/>[decoder.go]"]
  node_custom_fields["Terraform custom fields<br/>[dynamic.go]"]
end

node_terraform_cli(("Terraform CLI"))
node_cloudflare_api["Cloudflare REST API"]

node_terraform_cli -->|"starts plugin"| node_plugin_entry
node_plugin_entry -->|"constructs provider"| node_provider
node_provider -->|"registers resources"| node_account_service
node_provider -->|"registers resources"| node_access_rule
node_provider -->|"registers resources"| node_api_shield
node_provider -->|"registers resources"| node_content_scanning
node_provider -->|"registers resources"| node_ai_gateway
node_provider -->|"registers resources"| node_ai_search
node_account_service -->|"manages API objects"| node_cloudflare_api
node_access_rule -->|"manages API objects"| node_cloudflare_api
node_api_shield -->|"manages API objects"| node_cloudflare_api
node_content_scanning -->|"manages API objects"| node_cloudflare_api
node_certificate -->|"manages API objects"| node_cloudflare_api
node_connectivity -->|"manages API objects"| node_cloudflare_api
node_ai_gateway -->|"manages API objects"| node_cloudflare_api
node_ai_search -->|"manages API objects"| node_cloudflare_api
node_access_group -->|"models fields"| node_custom_fields

click node_plugin_entry "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/main.go"
click node_provider "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/provider.go"
click node_account_service "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/account/resource.go"
click node_access_rule "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/access_rule/resource.go"
click node_access_group "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/zero_trust_access_group/data_source_model.go"
click node_api_shield "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/api_shield/resource.go"
click node_content_scanning "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/content_scanning/resource.go"
click node_certificate "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/certificate_pack/resource.go"
click node_connectivity "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/connectivity_directory_service/resource.go"
click node_ai_gateway "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/ai_gateway/resource.go"
click node_ai_search "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/ai_search_instance/resource.go"
click node_worker_validation "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/workers_script/run_worker_first_validator.go"
click node_json_codec "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/apijson/decoder.go"
click node_custom_json_codec "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/apijsoncustom/decoder.go"
click node_custom_fields "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/customfield/dynamic.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_plugin_entry,node_provider toneBlue
class node_account_service,node_access_rule,node_access_group,node_api_shield,node_content_scanning toneAmber
class node_certificate,node_connectivity,node_ai_gateway,node_ai_search,node_worker_validation,node_cloudflare_api toneMint
class node_json_codec,node_custom_json_codec,node_custom_fields toneRose
class node_terraform_cli toneIndigo
```

## Components

### Provider runtime

- [Plugin entry](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/main.go): `main.go`
- [Provider setup](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/provider.go): `internal/provider.go`

### Account security

- [Account resources](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/account/resource.go): `internal/services/account/resource.go`
- [Access rules](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/access_rule/resource.go): `internal/services/access_rule/resource.go`
- [Access groups](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/zero_trust_access_group/data_source_model.go): `internal/services/zero_trust_access_group/data_source_model.go`
- [API Shield](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/api_shield/resource.go): `internal/services/api_shield/resource.go`
- [Content scanning](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/content_scanning/resource.go): `internal/services/content_scanning/resource.go`

### Platform services

- [Certificates](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/certificate_pack/resource.go): `internal/services/certificate_pack/resource.go`
- [Connectivity directory](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/connectivity_directory_service/resource.go): `internal/services/connectivity_directory_service/resource.go`
- [AI Gateway](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/ai_gateway/resource.go): `internal/services/ai_gateway/resource.go`
- [AI Search](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/ai_search_instance/resource.go): `internal/services/ai_search_instance/resource.go`
- [Worker validation](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/services/workers_script/run_worker_first_validator.go): `internal/services/workers_script/run_worker_first_validator.go`

### Internal representation

- [API JSON codec](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/apijson/decoder.go): `internal/apijson/decoder.go`
- [Custom JSON codec](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/apijsoncustom/decoder.go): `internal/apijsoncustom/decoder.go`
- [Terraform custom fields](https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/internal/customfield/dynamic.go): `internal/customfield/dynamic.go`

### Other components

- **Terraform CLI**
- **Cloudflare REST API**

## Connections

- Terraform CLI → Plugin entry: starts plugin
- Plugin entry → Provider setup: constructs provider
- Provider setup → Account resources: registers resources
- Provider setup → Access rules: registers resources
- Provider setup → API Shield: registers resources
- Provider setup → Content scanning: registers resources
- Provider setup → AI Gateway: registers resources
- Provider setup → AI Search: registers resources
- Account resources → Cloudflare REST API: manages API objects
- Access rules → Cloudflare REST API: manages API objects
- API Shield → Cloudflare REST API: manages API objects
- Content scanning → Cloudflare REST API: manages API objects
- Certificates → Cloudflare REST API: manages API objects
- Connectivity directory → Cloudflare REST API: manages API objects
- AI Gateway → Cloudflare REST API: manages API objects
- AI Search → Cloudflare REST API: manages API objects
- Access groups → Terraform custom fields: models fields