Resource of type cloudflare_notification_policy with alert_type "advanced_ddos_attack_l7_alert" can't be created

[brunorubin]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.3.4
on darwin_arm64
+ provider registry.terraform.io/cloudflare/cloudflare v4.0.0

and

Terraform v1.3.4
on darwin_arm64
+ provider registry.terraform.io/cloudflare/cloudflare v3.35.0

Affected resource(s)

• cloudflare_notification_policy

Terraform configuration files

resource "cloudflare_notification_policy" "ddos_notifications_type_l7" {
  account_id  = module.cloudflare_account.id
  name        = "DDoS Notification"
  enabled     = false
  alert_type  = "advanced_ddos_attack_l7_alert"

  filters {
    target_zone_name = ["sampledomain.com"]
    target_host      = ["sub.sampledomain.com"]
  }
}

Link to debug output

https://gist.github.com/brunorubin/f4594b792961c51df6c8f136a906c8fc

Panic output

No response

Expected output

cloudflare_notification_policy.ddos_notifications_type_l7: Creating...
cloudflare_notification_policy.ddos_notifications_type_l7: Creation complete after 3s [id=23c4901d88ce401e99a0a4b71b875917]

Actual output

│ Error: error creating policy DDoS: Invalid object selections (17003)
│
│   with cloudflare_notification_policy.ddos_notifications_type_l7,
│   on ddos.tf line 25, in resource "cloudflare_notification_policy" "ddos_notifications_type_l7":
│   25: resource "cloudflare_notification_policy" "ddos_notifications_type_l7" {
│

Steps to reproduce

1. Create a new cloudflare_notification_policy
2. Define alert_type to advanced_ddos_attack_l7_alert
3. Include a filter for hostname and zone:

  filters {
    target_host      = ["sampledomain.com"]
    target_zone_name = ["sub.sampledomain.com"]
  }

4. Run terraform apply

Additional factoids

When removing target_host the resource gets created normally:

  filters {
    target_zone_name = ["sampledomain.com"]
  }

---

Looks like the actual Cloudflare Schema expects target_hostname instead

      {
        "display_name": "Advanced HTTP DDoS Attack Alert",
        "type": "advanced_ddos_attack_l7_alert",
        "description": "Cloudflare detects and mitigates an HTTP DDoS attack against one of your domains",
        "filter_options": [
          {
            "Key": "requests_per_second",
            "ComparisonOperator": "\u003e=",
            "Optional": true
          },
          {
            "Key": "target_zone_name",
            "ComparisonOperator": "==",
            "Optional": true
          },
          {
            "Key": "target_hostname",
            "ComparisonOperator": "==",
            "Optional": true
          }
        ]
      }

References

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

This functionality has been released in v4.6.0 of the Terraform Cloudflare Provider.

Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!