---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "orcasecurity_integration_cloudflare Resource - orcasecurity"
subcategory: ""
description: |-
  Manage a Cloudflare integration in Orca.
---

# orcasecurity_integration_cloudflare (Resource)

Manages a [Cloudflare](https://www.cloudflare.com/) integration in Orca Security.

Under the hood this creates an entry under `POST /api/external_service/config`
with `service_name = "cloudflare"`. The API token is stored in Orca's secret
store and is never returned by the API.

## Example Usage

### Basic example

```terraform
# Cloudflare integration
resource "orcasecurity_integration_cloudflare" "example" {
  template_name = "test_cloudflare"
  api_token     = var.cloudflare_api_token
  is_enabled    = true
  is_default    = false
}
```

### Sourcing the token from HashiCorp Vault

```terraform
data "vault_generic_secret" "cf" {
  path = "secret/cloudflare/orca"
}

resource "orcasecurity_integration_cloudflare" "from_vault" {
  template_name = "cloudflare-prod"
  api_token     = data.vault_generic_secret.cf.data["api_token"]
}
```

## Argument Reference

* `template_name` — (Required, String) Identifier for the integration as shown
  in the Orca UI. Changing this forces a new resource.
* `api_token` — (Required, String, Sensitive) Cloudflare API token.
* `is_enabled` — (Optional, Bool) Defaults to `true`.
* `is_default` — (Optional, Bool) Defaults to `false`.

## Attribute Reference

* `id` — (String) Orca external service config identifier (UUID).

## Notes

* Orca strips `api_token` from `GET` responses (stored in SSM). The provider
  keeps the value already in Terraform state to avoid permanent diffs. Rotate
  through `terraform apply`; for out-of-band rotation use
  `terraform apply -replace=orcasecurity_integration_cloudflare.example`.
* Use an encrypted remote backend (S3 + KMS, GCS, Terraform Cloud, etc.) and
  restrict read access to the state.

## Import

```bash
terraform import orcasecurity_integration_cloudflare.example test_cloudflare
```

After import, set the `api_token` argument in your configuration — the API
does not return it.