---
title: IAM
---
[Skip to content](#_top)
[API Reference](https://developers.cloudflare.com/api/terraform)
Copy Markdown
Open in **Claude**Open in **ChatGPT**Open in **Cursor**
---
**Copy Markdown****View as Markdown**
# IAM
#### IAMPermission Groups
#### data cloudflare\_account\_permission\_group
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20account_id>)
permission\_group\_id: String
Permission Group identifier tag.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20permission_group_id>)
##### computed Expand Collapse
id: String
Identifier of the permission group.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20id>)
name: String
Name of the permission group.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20name>)
meta: Attributes
Attributes associated to the permission group.
category: String
A category used to group permission groups.
Link to this property
deprecated: String
Indicates whether the permission group is deprecated.
Link to this property
description: String
Additional information about the permission group.
Link to this property
editable: String
Indicates whether the permission group can be edited.
Link to this property
eol\_at: Time
The planned end-of-life date and time, when provided.
Link to this property
label: String
A label identifying the permission group.
Link to this property
scopes: String
The scope associated with the permission group.
Link to this property
visibility: String
Indicates the permission group’s availability or visibility.
Link to this property
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20meta>)
### cloudflare\_account\_permission\_group
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_account_permission_group" "example_account_permission_group" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
permission_group_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
```
#### data cloudflare\_account\_permission\_groups
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
id?: String
ID of the permission group to be fetched.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20id>)
label?: String
Label of the permission group to be fetched.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20label>)
name?: String
Name of the permission group to be fetched.
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20name>)
max\_items?: Int64
Max items to fetch, default: 1000
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20max_items>)
##### computed Expand Collapse
result: List\[Attributes]
The items returned by the data source
id: String
Identifier of the permission group.
Link to this property
meta: Attributes
Attributes associated to the permission group.
category: String
A category used to group permission groups.
Link to this property
deprecated: String
Indicates whether the permission group is deprecated.
Link to this property
description: String
Additional information about the permission group.
Link to this property
editable: String
Indicates whether the permission group can be edited.
Link to this property
eol\_at: Time
The planned end-of-life date and time, when provided.
Link to this property
label: String
A label identifying the permission group.
Link to this property
scopes: String
The scope associated with the permission group.
Link to this property
visibility: String
Indicates the permission group’s availability or visibility.
Link to this property
Link to this property
name: String
Name of the permission group.
Link to this property
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20result>)
### cloudflare\_account\_permission\_groups
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_account_permission_groups" "example_account_permission_groups" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
id = "6d7f2f5f5b1d4a0e9081fdc98d432fd1"
label = "labelOfThePermissionGroup"
name = "NameOfThePermissionGroup"
}
```
#### IAMResource Groups
#### data cloudflare\_resource\_group
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20account_id>)
resource\_group\_id: String
Resource Group identifier tag.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20resource_group_id>)
##### computed Expand Collapse
id: String
Identifier of the resource group.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20id>)
name: String
Name of the resource group.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20name>)
meta: Attributes
Attributes associated to the resource group.
key: String
Link to this property
value: String
Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20meta>)
scope: Attributes
A scope is a combination of scope objects which provides additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Account ID etc.)
Link to this property
objects: List\[Attributes]
A list of scope objects for additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Zone ID etc.)
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20scope>)
### cloudflare\_resource\_group
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_resource_group" "example_resource_group" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
resource_group_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
```
#### data cloudflare\_resource\_groups
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
id?: String
ID of the resource group to be fetched.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20id>)
name?: String
Name of the resource group to be fetched.
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20name>)
max\_items?: Int64
Max items to fetch, default: 1000
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20max_items>)
##### computed Expand Collapse
result: List\[Attributes]
The items returned by the data source
id: String
Identifier of the resource group.
Link to this property
scope: Attributes
A scope is a combination of scope objects which provides additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Account ID etc.)
Link to this property
objects: List\[Attributes]
A list of scope objects for additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Zone ID etc.)
Link to this property
Link to this property
Link to this property
meta: Attributes
Attributes associated to the resource group.
key: String
Link to this property
value: String
Link to this property
Link to this property
name: String
Name of the resource group.
Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20result>)
### cloudflare\_resource\_groups
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_resource_groups" "example_resource_groups" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
id = "023e105f4ecef8ad9ca31a8372d0c353"
name = "NameOfTheResourceGroup"
}
```
#### IAMUser Groups
#### resource cloudflare\_user\_group
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20account_id>)
name: String
Name of the User group.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20name>)
##### optional Expand Collapse
policies?: List\[Attributes]
Policies attached to the User group
access: String
Allow or deny operations against the resources.
Link to this property
permission\_groups: List\[Attributes]
A set of permission groups that are specified to the policy.
id: String
Permission Group identifier tag.
Link to this property
Link to this property
resource\_groups: List\[Attributes]
A set of resource groups that are specified to the policy.
id: String
Resource Group identifier tag.
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20policies>)
##### computed Expand Collapse
id: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20id>)
created\_on: Time
Timestamp for the creation of the user group
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20created_on>)
modified\_on: Time
Last time the user group was modified.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20modified_on>)
### cloudflare\_user\_group
Terraform
HTTPTypeScriptPythonGoTerraform
```
resource "cloudflare_user_group" "example_user_group" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
name = "My New User Group"
policies = [{
access = "allow"
permission_groups = [{
id = "c8fed203ed3043cba015a93ad1616f1f"
}, {
id = "82e64a83756745bbbb1c9c2701bf816b"
}]
resource_groups = [{
id = "6d7f2f5f5b1d4a0e9081fdc98d432fd1"
}]
}]
}
```
#### data cloudflare\_user\_group
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
user\_group\_id?: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20user_group_id>)
filter?: Attributes
id?: String
ID of the user group to be fetched.
Link to this property
direction?: String
The sort order of returned user groups by name (ascending or descending).
Link to this property
fuzzy\_name?: String
A string used for searching for user groups containing that substring.
Link to this property
name?: String
Name of the user group to be fetched.
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20filter>)
##### computed Expand Collapse
id: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20id>)
created\_on: Time
Timestamp for the creation of the user group
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20created_on>)
modified\_on: Time
Last time the user group was modified.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20modified_on>)
name: String
Name of the user group.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20name>)
policies: List\[Attributes]
Policies attached to the User group
id: String
Policy identifier.
Link to this property
access: String
Allow or deny operations against the resources.
Link to this property
permission\_groups: List\[Attributes]
A set of permission groups that are specified to the policy.
id: String
Identifier of the permission group.
Link to this property
meta: Attributes
Attributes associated to the permission group.
category: String
A category used to group permission groups.
Link to this property
deprecated: String
Indicates whether the permission group is deprecated.
Link to this property
description: String
Additional information about the permission group.
Link to this property
editable: String
Indicates whether the permission group can be edited.
Link to this property
eol\_at: Time
The planned end-of-life date and time, when provided.
Link to this property
label: String
A label identifying the permission group.
Link to this property
scopes: String
The scope associated with the permission group.
Link to this property
visibility: String
Indicates the permission group’s availability or visibility.
Link to this property
Link to this property
name: String
Name of the permission group.
Link to this property
Link to this property
resource\_groups: List\[Attributes]
A list of resource groups that the policy applies to.
id: String
Identifier of the resource group.
Link to this property
scope: Attributes
A scope is a combination of scope objects which provides additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Account ID etc.)
Link to this property
objects: List\[Attributes]
A list of scope objects for additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Zone ID etc.)
Link to this property
Link to this property
Link to this property
meta: Attributes
Attributes associated to the resource group.
key: String
Link to this property
value: String
Link to this property
Link to this property
name: String
Name of the resource group.
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20policies>)
### cloudflare\_user\_group
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_user_group" "example_user_group" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
user_group_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
```
#### data cloudflare\_user\_groups
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
fuzzy\_name?: String
A string used for searching for user groups containing that substring.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20fuzzy_name>)
id?: String
ID of the user group to be fetched.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20id>)
name?: String
Name of the user group to be fetched.
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20name>)
direction?: String
The sort order of returned user groups by name (ascending or descending).
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20direction>)
max\_items?: Int64
Max items to fetch, default: 1000
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20max_items>)
##### computed Expand Collapse
result: List\[Attributes]
The items returned by the data source
id: String
User Group identifier tag.
Link to this property
created\_on: Time
Timestamp for the creation of the user group
Link to this property
modified\_on: Time
Last time the user group was modified.
Link to this property
name: String
Name of the user group.
Link to this property
policies: List\[Attributes]
Policies attached to the User group
id: String
Policy identifier.
Link to this property
access: String
Allow or deny operations against the resources.
Link to this property
permission\_groups: List\[Attributes]
A set of permission groups that are specified to the policy.
id: String
Identifier of the permission group.
Link to this property
meta: Attributes
Attributes associated to the permission group.
category: String
A category used to group permission groups.
Link to this property
deprecated: String
Indicates whether the permission group is deprecated.
Link to this property
description: String
Additional information about the permission group.
Link to this property
editable: String
Indicates whether the permission group can be edited.
Link to this property
eol\_at: Time
The planned end-of-life date and time, when provided.
Link to this property
label: String
A label identifying the permission group.
Link to this property
scopes: String
The scope associated with the permission group.
Link to this property
visibility: String
Indicates the permission group’s availability or visibility.
Link to this property
Link to this property
name: String
Name of the permission group.
Link to this property
Link to this property
resource\_groups: List\[Attributes]
A list of resource groups that the policy applies to.
id: String
Identifier of the resource group.
Link to this property
scope: Attributes
A scope is a combination of scope objects which provides additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Account ID etc.)
Link to this property
objects: List\[Attributes]
A list of scope objects for additional context.
key: String
This is a combination of pre-defined resource name and identifier (like Zone ID etc.)
Link to this property
Link to this property
Link to this property
meta: Attributes
Attributes associated to the resource group.
key: String
Link to this property
value: String
Link to this property
Link to this property
name: String
Name of the resource group.
Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20result>)
### cloudflare\_user\_groups
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_user_groups" "example_user_groups" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
id = "023e105f4ecef8ad9ca31a8372d0c353"
fuzzy_name = "Foo"
name = "NameOfTheUserGroup"
}
```
#### IAMUser GroupsMembers
#### resource cloudflare\_user\_group\_members
##### required Expand Collapse
user\_group\_id: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20user_group_id>)
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20account_id>)
members: List\[Attributes]
id: String
The identifier of an existing account Member.
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20members>)
##### computed Expand Collapse
id: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20id>)
### cloudflare\_user\_group\_members
Terraform
HTTPTypeScriptPythonGoTerraform
```
resource "cloudflare_user_group_members" "example_user_group_members" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
user_group_id = "023e105f4ecef8ad9ca31a8372d0c353"
members = [{
id = "023e105f4ecef8ad9ca31a8372d0c353"
}]
}
```
#### data cloudflare\_user\_group\_members
##### required Expand Collapse
user\_group\_id: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20user_group_id>)
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
fuzzy\_email?: String
A string used for filtering members by partial email match.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20fuzzy_email>)
direction?: String
The sort order of returned user group members by email.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20direction>)
##### computed Expand Collapse
id: String
User Group identifier tag.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20id>)
email: String
The contact email address of the user.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20email>)
status: String
The member’s status in the account.
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20status>)
### cloudflare\_user\_group\_members
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_user_group_members" "example_user_group_members" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
user_group_id = "023e105f4ecef8ad9ca31a8372d0c353"
direction = "asc"
fuzzy_email = "user@"
}
```
#### IAMSSO
#### resource cloudflare\_sso\_connector
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20account_id>)
email\_domain: String
Email domain of the new SSO connector
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20email_domain>)
##### optional Expand Collapse
begin\_verification?: Bool
Begin the verification process after creation
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20begin_verification>)
enabled?: Bool
SSO Connector enabled state
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20enabled>)
use\_fedramp\_language?: Bool
Controls the display of FedRAMP language to the user during SSO login
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20use_fedramp_language>)
##### computed Expand Collapse
id: String
SSO Connector identifier tag.
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20id>)
created\_on: Time
Timestamp for the creation of the SSO connector
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20created_on>)
updated\_on: Time
Timestamp for the last update of the SSO connector
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20updated_on>)
verification: Attributes
code: String
DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.
Link to this property
status: String
The status of the verification code from the verification process.
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20verification>)
### cloudflare\_sso\_connector
Terraform
HTTPTypeScriptPythonGoTerraform
```
resource "cloudflare_sso_connector" "example_sso_connector" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
email_domain = "example.com"
begin_verification = true
use_fedramp_language = false
}
```
#### data cloudflare\_sso\_connector
##### required Expand Collapse
sso\_connector\_id: String
SSO Connector identifier tag.
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20sso_connector_id>)
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20account_id>)
##### computed Expand Collapse
id: String
SSO Connector identifier tag.
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20id>)
created\_on: Time
Timestamp for the creation of the SSO connector
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20created_on>)
email\_domain: String
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20email_domain>)
enabled: Bool
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20enabled>)
updated\_on: Time
Timestamp for the last update of the SSO connector
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20updated_on>)
use\_fedramp\_language: Bool
Controls the display of FedRAMP language to the user during SSO login
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20use_fedramp_language>)
verification: Attributes
code: String
DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.
Link to this property
status: String
The status of the verification code from the verification process.
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20verification>)
### cloudflare\_sso\_connector
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_sso_connector" "example_sso_connector" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
sso_connector_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
```
#### data cloudflare\_sso\_connectors
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
max\_items?: Int64
Max items to fetch, default: 1000
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20max_items>)
##### computed Expand Collapse
result: List\[Attributes]
The items returned by the data source
id: String
SSO Connector identifier tag.
Link to this property
created\_on: Time
Timestamp for the creation of the SSO connector
Link to this property
email\_domain: String
Link to this property
enabled: Bool
Link to this property
updated\_on: Time
Timestamp for the last update of the SSO connector
Link to this property
use\_fedramp\_language: Bool
Controls the display of FedRAMP language to the user during SSO login
Link to this property
verification: Attributes
code: String
DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.
Link to this property
status: String
The status of the verification code from the verification process.
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20result>)
### cloudflare\_sso\_connectors
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_sso_connectors" "example_sso_connectors" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
```
#### IAMOAuth Clients
#### resource cloudflare\_oauth\_client
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20account_id>)
client\_name: String
Human-readable name of the OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20client_name>)
token\_endpoint\_auth\_method: String
The authentication method the client uses at the token endpoint.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20token_endpoint_auth_method>)
grant\_types: List\[String]
Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20grant_types>)
redirect\_uris: List\[String]
Array of allowed redirect URIs for the client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20redirect_uris>)
response\_types: List\[String]
Array of OAuth response types the client is allowed to use.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20response_types>)
scopes: List\[String]
Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20scopes>)
##### optional Expand Collapse
oauth\_client\_id?: String
The unique identifier for an OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20oauth_client_id>)
client\_uri?: String
URL of the home page of the client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20client_uri>)
logo\_uri?: String
URL of the client’s logo.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20logo_uri>)
policy\_uri?: String
URL that points to a privacy policy document.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20policy_uri>)
tos\_uri?: String
URL that points to a terms of service document.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20tos_uri>)
visibility?: String
Promote the OAuth client from private to public visibility. Only `public` is accepted; demotion to `private` is not supported. Promotion requires a non-empty client name, logo URI, verified client URI host, and at least one non-identity scope.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20visibility>)
allowed\_cors\_origins?: List\[String]
Array of allowed CORS origins.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20allowed_cors_origins>)
optional\_scopes?: List\[String]
Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20optional_scopes>)
post\_logout\_redirect\_uris?: List\[String]
Array of allowed post-logout redirect URIs.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20post_logout_redirect_uris>)
##### computed Expand Collapse
client\_id: String
The unique identifier for an OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20client_id>)
client\_secret: String
The client secret. This is the only time the secret is returned in a response.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20client_secret>)
created\_at: Time
Timestamp when the OAuth client was created.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20created_at>)
has\_rotated\_secret: Bool
Indicates whether the client has a rotated secret that has not yet been deleted.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20has_rotated_secret>)
promoted\_at: Time
Timestamp when the OAuth client was promoted to public visibility.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20promoted_at>)
updated\_at: Time
Timestamp when the OAuth client was last updated.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20updated_at>)
client\_uri\_verification: Attributes
Client URI domain control verification state.
status: String
Current verification status for the client URI host.
Link to this property
text: String
Exact TXT record value that must be added to DNS to prove ownership of the client URI host.
Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20resource)%20%3E%20(attribute)%20client_uri_verification>)
### cloudflare\_oauth\_client
Terraform
HTTPTypeScriptPythonGoTerraform
```
resource "cloudflare_oauth_client" "example_oauth_client" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
client_name = "My OAuth App"
grant_types = ["authorization_code", "refresh_token"]
redirect_uris = ["https://example.com/callback"]
response_types = ["code"]
scopes = ["account.read"]
token_endpoint_auth_method = "client_secret_post"
allowed_cors_origins = ["https://example.com"]
client_uri = "https://example.com"
logo_uri = "https://example.com/logo.png"
optional_scopes = ["account.write"]
policy_uri = "https://example.com/privacy"
post_logout_redirect_uris = ["https://example.com/logout"]
tos_uri = "https://example.com/tos"
}
```
#### data cloudflare\_oauth\_client
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20account_id>)
oauth\_client\_id: String
The unique identifier for an OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20oauth_client_id>)
##### computed Expand Collapse
client\_id: String
The unique identifier for an OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20client_id>)
client\_name: String
Human-readable name of the OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20client_name>)
client\_uri: String
URL of the home page of the client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20client_uri>)
created\_at: Time
Timestamp when the OAuth client was created.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20created_at>)
has\_rotated\_secret: Bool
Indicates whether the client has a rotated secret that has not yet been deleted.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20has_rotated_secret>)
logo\_uri: String
URL of the client’s logo.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20logo_uri>)
policy\_uri: String
URL that points to a privacy policy document.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20policy_uri>)
promoted\_at: Time
Timestamp when the OAuth client was promoted to public visibility.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20promoted_at>)
token\_endpoint\_auth\_method: String
The authentication method the client uses at the token endpoint.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20token_endpoint_auth_method>)
tos\_uri: String
URL that points to a terms of service document.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20tos_uri>)
updated\_at: Time
Timestamp when the OAuth client was last updated.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20updated_at>)
visibility: String
Visibility of the OAuth client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20visibility>)
allowed\_cors\_origins: List\[String]
Array of allowed CORS origins.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20allowed_cors_origins>)
grant\_types: List\[String]
Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20grant_types>)
optional\_scopes: List\[String]
Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20optional_scopes>)
post\_logout\_redirect\_uris: List\[String]
Array of allowed post-logout redirect URIs.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20post_logout_redirect_uris>)
redirect\_uris: List\[String]
Array of allowed redirect URIs for the client.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20redirect_uris>)
response\_types: List\[String]
Array of OAuth response types the client is allowed to use.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20response_types>)
scopes: List\[String]
Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20scopes>)
client\_uri\_verification: Attributes
Client URI domain control verification state.
status: String
Current verification status for the client URI host.
Link to this property
text: String
Exact TXT record value that must be added to DNS to prove ownership of the client URI host.
Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-single)%20%3E%20(attribute)%20client_uri_verification>)
### cloudflare\_oauth\_client
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_oauth_client" "example_oauth_client" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
oauth_client_id = "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
```
#### data cloudflare\_oauth\_clients
##### required Expand Collapse
account\_id: String
Account identifier tag.
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20account_id>)
##### optional Expand Collapse
max\_items?: Int64
Max items to fetch, default: 1000
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20max_items>)
##### computed Expand Collapse
result: List\[Attributes]
The items returned by the data source
client\_id: String
The unique identifier for an OAuth client.
Link to this property
visibility: String
Visibility of the OAuth client.
Link to this property
allowed\_cors\_origins: List\[String]
Array of allowed CORS origins.
Link to this property
client\_name: String
Human-readable name of the OAuth client.
Link to this property
client\_uri: String
URL of the home page of the client.
Link to this property
client\_uri\_verification: Attributes
Client URI domain control verification state.
status: String
Current verification status for the client URI host.
Link to this property
text: String
Exact TXT record value that must be added to DNS to prove ownership of the client URI host.
Link to this property
Link to this property
created\_at: Time
Timestamp when the OAuth client was created.
Link to this property
grant\_types: List\[String]
Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally.
Link to this property
has\_rotated\_secret: Bool
Indicates whether the client has a rotated secret that has not yet been deleted.
Link to this property
logo\_uri: String
URL of the client’s logo.
Link to this property
optional\_scopes: List\[String]
Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional.
Link to this property
policy\_uri: String
URL that points to a privacy policy document.
Link to this property
post\_logout\_redirect\_uris: List\[String]
Array of allowed post-logout redirect URIs.
Link to this property
promoted\_at: Time
Timestamp when the OAuth client was promoted to public visibility.
Link to this property
redirect\_uris: List\[String]
Array of allowed redirect URIs for the client.
Link to this property
response\_types: List\[String]
Array of OAuth response types the client is allowed to use.
Link to this property
scopes: List\[String]
Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types.
Link to this property
token\_endpoint\_auth\_method: String
The authentication method the client uses at the token endpoint.
Link to this property
tos\_uri: String
URL that points to a terms of service document.
Link to this property
updated\_at: Time
Timestamp when the OAuth client was last updated.
Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20result>)
### cloudflare\_oauth\_clients
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_oauth_clients" "example_oauth_clients" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
```
#### IAMOAuth Scopes
#### data cloudflare\_oauth\_scopes
##### optional Expand Collapse
max\_items?: Int64
Max items to fetch, default: 1000
[Link to this property](<#(resource)%20iam.oauth_scopes%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20max_items>)
##### computed Expand Collapse
result: List\[Attributes]
The items returned by the data source
id: String
The scope label to use in the scopes array when creating or updating an OAuth client.
Link to this property
name: String
Human-readable name of the OAuth scope.
Link to this property
category: String
Category for grouping scopes in the UI.
Link to this property
scopes: List\[String]
The underlying resource scopes (Bach scopes) that define which resources this OAuth scope can act upon.
Link to this property
[Link to this property](<#(resource)%20iam.oauth_scopes%20%3E%20(terraform%20datasource-plural)%20%3E%20(attribute)%20result>)
### cloudflare\_oauth\_scopes
Terraform
HTTPTypeScriptPythonGoTerraform
```
data "cloudflare_oauth_scopes" "example_oauth_scopes" {
}
```