Each Cloudflare setting has one reconciler. This boundary prevents Terraform and Wrangler from overwriting each other.
| Resource or setting | Owner |
|---|---|
| Cloudflare account resources | Terraform |
| Zone lifecycle | Terraform |
| Ordinary DNS records | Terraform |
| Worker identity | Terraform |
| Durable R2 buckets | Terraform |
| Durable D1 databases | Terraform |
| Durable Queues | Terraform |
| Turnstile widgets | Trusted auth bootstrap |
| Zero Trust organization | Terraform |
| Access applications and policy | Terraform |
| Worker code and static assets | Wrangler |
| Worker versions and deployments | Wrangler |
| Application bindings | Wrangler |
| Gateway Worker Routes | Gateway Wrangler configuration |
| Origin Worker Custom Domains | Origin application Wrangler configuration |
| Deployment observability | Wrangler |
| Email event subscriptions | Trusted application reconciler |
Cloudflare creates the DNS record and certificate for a Worker Custom Domain. Wrangler therefore owns that deployment-coupled domain instead of Terraform. The gateway owns the Worker Routes for its configured origin Custom Domains. The origin application remains the only owner of its Custom Domain.
Turnstile is the deliberate exception to Terraform ownership. Cloudflare generates a widget secret, so placing the widget in Terraform would also place that secret in Terraform state. Auth's trusted production preparation finds its named widget or creates it when absent, then validates its name, managed mode, domain restriction, site key, and secret. It passes the generated secret through a restricted temporary file to the Worker secret-installation step. The generated value is not a Terraform value or a checked-in configuration.
Terraform owns the account-level Zero Trust organization before it creates an Access policy or application. A retained import block records any existing organization that Terraform adopts.
Terraform creates the Worker identity and required storage. Wrangler then deploys code against those stable resources. Removing an application requires an explicit review of both ownership surfaces.
When the Terraform provider does not expose a required lifecycle, the trusted workflow may run a narrow, idempotent API reconciler. Auth uses one for its Email Sending lifecycle subscription. The reconciler creates or updates one named subscription and fails when duplicate ownership is present.
For application-specific resources, refer to StormTrust applications.