API Token 403 on zone creation

[abulfat-m]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

3.3.0

Affected resource(s)

cloudflare_zone

Terraform configuration files

resource "cloudflare_zone" "this" {
  zone       = var.zone_name
  paused     = var.paused
  jump_start = var.jump_start
  plan       = var.plan // = enterprise
  type       = var.type
}

Debug output

Error: error creating zone "...........com": HTTP status 400: Permission denied (1068)

with module.zone_base_config.cloudflare_zone.this[0],

on .terraform/modules/zone_base_config/zone.tf line 1, in resource "cloudflare_zone" "this":

1: resource "cloudflare_zone" "this" {

time=2022-01-13T17:32:17Z level=error msg=1 error occurred:

* exit status 1

Panic output

No response

Expected output

zone created

Actual output

Error: error creating zone "...............com": HTTP status 400: Permission denied (1068)

with module.zone_base_config.cloudflare_zone.this[0],

on .terraform/modules/zone_base_config/zone.tf line 1, in resource "cloudflare_zone" "this":

1: resource "cloudflare_zone" "this" {

time=2022-01-13T17:32:17Z level=error msg=1 error occurred:

* exit status 1

Steps to reproduce

1. Create API Token with the following permissions:
   Account-level - Billing:Edit, Account Settings:Edit
   All zones - Zone WAF:Edit, Zone Settings:Edit, Zone:Edit, SSL and Certificates:Edit, Logs:Edit, DNS:Edit, Analytics:Read
2. Use token in Terraform provider and try to create a zone using cloudflare_zone resource.

Additional factoids

According to #1102 and @jacobbednarz, API token should have worked.
As per Cloudflare, API Keys are considered legacy and not recommended to use, therefore we need to use API Tokens instead.

References

#1102
#1101

[jacobbednarz]

These are the bare minimums you need for zone creation using an API token.

All accounts - Billing:Edit, Account Settings:Edit
All zones - Zone Settings:Edit, Zone:Edit

There is already a test that you can use for this locally.

$ CLOUDFLARE_API_TOKEN="xxx" TF_ACC=1 TESTARGS='-run "^TestAccCloudflareZone_WithPlan" -count 1 -parallel 1' make testacc
TF_ACC=1 go test $(go list ./...) -v -run "^TestAccCloudflareZone_WithPlan" -count 1 -parallel 1 -timeout 120m -parallel 1
?   	github.com/cloudflare/terraform-provider-cloudflare	[no test files]
=== RUN   TestAccCloudflareZone_WithPlan
--- PASS: TestAccCloudflareZone_WithPlan (16.15s)
PASS
ok  	github.com/cloudflare/terraform-provider-cloudflare/cloudflare	16.442s
?   	github.com/cloudflare/terraform-provider-cloudflare/tools/cmd/changelog-check	[no test files]
?   	github.com/cloudflare/terraform-provider-cloudflare/version	[no test files]

Your error is the key here as it says permission denied which suggests you don't have enough permissions in the account you are trying to create a new zone in.