cloudflare_zone_setting fails writing proxy_read_timeout when creating zone

[mjcaley]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Cloudflare provider: 5.15.0
Terraform: 1.14.3

Affected resource(s)

cloudflare_zone_setting

Terraform configuration files

resource "cloudflare_zone" "zone" {
  account = {
    id = var.cloudflare_account_id
  }
  name = var.cf_origin
  type = "partial"
}

resource "cloudflare_zone_subscription" "zone" {
  zone_id   = cloudflare_zone.zone.id
  frequency = "yearly"
  rate_plan = {
    id    = "enterprise"
    scope = "zone"
  }
}

resource "cloudflare_zone_setting" "proxy_read_timeout" {
  zone_id    = cloudflare_zone.zone.id
  setting_id = "proxy_read_timeout"
  value      = 600
  depends_on = [cloudflare_zone_subscription.zone]
}

Link to debug output

https://gist.github.com/mjcaley/48c4ac997cff6446154ec9ea1bba9cb1

Panic output

No response

Expected output

module.prd1zuk1.cloudflare_zone_setting.proxy_read_timeout: Creating...
...
module.prd1zuk1.cloudflare_zone_setting.proxy_read_timeout: Creation complete after 0s [id=proxy_read_timeout]

Actual output

╷
│ Error: failed to make http request
│
│ with module.prd1zus1.cloudflare_zone_setting.proxy_read_timeout,
│ on ....\modules\zone\main.tf line 116, in resource "cloudflare_zone_setting" "proxy_read_timeout":
│ 116: resource "cloudflare_zone_setting" "proxy_read_timeout" {
│
│ PATCH "https://api.cloudflare.com/client/v4/zones/2ecea76e4a2278af3f9cb936b6ffeacf/settings/proxy_read_timeout": 400 Bad Request {"success":false,"errors":[{"code":1015,"message":"Not allowed to edit setting for proxy_read_timeout"}],"messages":[],"result":null}
╵

Steps to reproduce

1. Create a zone, set the subscription to be Enterprise
2. Create a cloudflare_zone_setting resource that sets "proxy_read_timeout" (this requires the zone to be Enterprise to be set)
3. Apply Terraform
4. First attempt will usually fail. Second attempt even less than a minute will be successful

Additional factoids

No response

References

No response

[mgirouard]

Thanks for the report @mjcaley. It looks like this particular error would come from either: 1) the zone not being Enterprise; or 2) the credential attempting to make the request doesn't have access to that particular zone.

One thing that you might want to try is to make a vanilla curl call to that zone with the same API token (or key) that your Terraform setup uses. If the zone doesn't come back, or it's .plan.name attribute isn't "Enterprise Website", that will likely be your root cause.

Either way, let me know how it plays out.

[mjcaley]

Hi @mgirouard. So they way I have it setup is that it'll create the zone, then set it to Enterprise. It usually fails at this point, and once I retry with no changes it'll be successful. So the account is fine too.

I think it's some kind of race condition where setting it to Enterprise doesn't reflect right away.

I've added a time_sleep resource for now to see if that'll get around it.

[vaishakdinesh]

Hi! @mjcaley Did that solve your issue or are you still facing this?
cc: @mgirouard