The Complete Production SOP: How to Deploy and Run Cloudflare DNS Record Automation & Proxied Traffic in Autonomous AI Agents

---
name: "cloudflare-dns-records-management"
description: "Automate high-speed DNS record management and CDN proxying via Terraform and Cloudflare API."
metadata:
  author: "Cloudflare"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "automate cloudflare dns terraform"
  - "toggle cloudflare proxy status"
  - "cname flattening cloudflare"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Cloudflare DNS Record Automation & Proxied Traffic

Manages Cloudflare DNS: creating A, AAAA, CNAME, and TXT records, toggling proxied status (orange cloud), configuring CNAME flattening at apex (@), and handling automated DNS migrations.

## When to Invoke
Invoke this skill whenever you need to:
- automate cloudflare dns terraform
- toggle cloudflare proxy status
- cname flattening cloudflare

## Execution SOP & Rules
1. Declare cloudflare_record resource specifying zone_id, name, value, type, and proxied = true.
2. Set proxied = true to activate Cloudflare DDoS protection, WAF, and edge caching.
3. Set proxied = false (gray cloud) for direct origin connections such as SSH or VPN hosts.
4. Verify DNS propagation globally using dig @1.1.1.1 <domain> and DNS checker tools.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.30.0"
    }
  }
}

provider "cloudflare" {
  # Relies on CLOUDFLARE_API_TOKEN environment variable
}

variable "zone_id" {
  type        = string
  description = "The Cloudflare Zone ID"
}

# Apex record leveraging Cloudflare native CNAME flattening
resource "cloudflare_record" "apex_cname" {
  zone_id = var.zone_id
  name    = "@"
  content = "edge.example-alb.com"
  type    = "CNAME"
  proxied = true
  ttl     = 1 # Automatic TTL when proxied
  comment = "Managed by Cloudflare DNS Record Automation Skill"
}

# Direct origin record (SSH/Direct access) - explicitly unproxied
resource "cloudflare_record" "origin_ssh" {
  zone_id = var.zone_id
  name    = "ssh"
  content = "198.51.100.10"
  type    = "A"
  proxied = false # Grey cloud: bypassed CDN/WAF
  ttl     = 300
  comment = "Direct origin access, unproxied"
}

#!/usr/bin/env bash
set -euo pipefail

echo "Validating HCL syntax and formatting..."
terraform fmt -check -diff

echo "Validating provider configurations..."
terraform init -backend=false
terraform validate

echo "Cloudflare DNS configuration successfully verified."