Multiple cloudflare_rulesets deployment via terraform

[madami]

Hello,

I’d like to deploy my configuration via Terraform but I’m facing some issues when I deploy multiple cloudflare_rulesets.

I have now two rulesets of type http_response_headers_transform:

• if I deploy the first one on its own, everything is ok
• if I deploy the second one on its own, everything is ok
• If I deploy both at the same time, the terraform apply fails with the following message

╷
│ Error: failed to create ruleset “http_response_headers_transform” as a similar configuration with rules already exists and overwriting will have unintended consequences. If you are migrating from the Dashboard, you will need to first remove the existing rules otherwise you can remove the existing phase yourself using the API (Cloudflare API v4 Documentation).

The message refers to existing rules, but those are the only ones available in this domain and none were created via the dashboard.

The two rules are below:

resource “cloudflare_ruleset” “remove_common_IIS_headers” {
zone_id = var.cloudflare_zone_id
name = “Remove common IIS headers”
description = “Remove common IIS headers”
kind = “zone”
phase = “http_response_headers_transform”
rules {
action = “rewrite”
action_parameters {
headers {
name = “x-aspnet-version”
operation = “remove”
}
headers {
name = “x-aspnetmvc-version”
operation = “remove”
}
headers {
name = “x-powered-by”
operation = “remove”
}
}
expression = “(http.host matches ".*.${var.domain}")”
description = “All domains”
enabled = true
}
}

resource “cloudflare_ruleset” “Disable_ACC_and_STA_indexing” {
zone_id = var.cloudflare_zone_id
name = “Disable indexing for ACC and STA”
description = “Disable indexing for ACC and STA by setting the X-Robots-Tag header to none”
kind = “zone”
phase = “http_response_headers_transform”
rules {
action = “rewrite”
action_parameters {
headers {
name = “x-robots-tag”
operation = “set”
value = “none”
}
}
expression = “(http.host matches ".*-(acc|sta).${var.domain}")”
description = “All subdomains containing -acc and -sta”
enabled = true
}
}

Any idea?

[madami]

Apparently somebody else had the same issue, but there was no indication if / how this was solved.

Cloudflare Provider: Terraform failed to create ruleset as a similar...

[Cyb3r-Jak3]

I’m wondering if your state has been messed up making terraform, thinking it needs to recreate the ruleset.
Can you try importing the ruleset? If that doesn’t work, then I would open a bug report on the terraform repo.

[madami]

Hello,

thanks for your reply.

My state is correct as it only contains the “remove_common_IIS_headers” ruleset.

If I run a terraform plan, it correctly tells me it needs to create the “Disable_ACC_and_STA_indexing” ruleset and the terraform plan succeeds. It’s the terraform apply which then fails.

The fact that my state is correct should be confirmed by the fact that if I comment one of the ruleset, the uncommented gets applied and the other gets removed (if it was present).

Also, this is a brand new domain I am deploying exclusively via Terraform, so it’s really “clean”.

[madami]

I had also posted the issue on the terraform repo as you had suggested and they pointed out that I should create one rulesets and two entrypoints.

In practice, I’ve changed my rule with the following and now it works.

resource “cloudflare_ruleset” “rewrite_response_headers” {
zone_id = var.cloudflare_zone_id
name = “Remove common IIS headers”
description = “Remove common IIS headers”
kind = “zone”
phase = “http_response_headers_transform”
rules {
action = “rewrite”
action_parameters {
headers {
name = “x-aspnet-version”
operation = “remove”
}
headers {
name = “x-aspnetmvc-version”
operation = “remove”
}
headers {
name = “x-powered-by”
operation = “remove”
}
}
expression = “(http.host matches ".*.${var.domain}")”
description = “Remove common IIS header”
enabled = true
}

rules {
action = “rewrite”
action_parameters {
headers {
name = “x-robots-tag”
operation = “set”
value = “none”
}
}
expression = “(http.host matches ".*-(acc|sta).${var.domain}")”
description = “Disable_ACC_and_STA_indexing”
enabled = true
}
}