provider: allow configuring x-auth-service-key individually

.changelog/1907.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider: allow setting `api_user_service_key` without token and/or key
+```

docs/index.md

@@ -57,9 +57,9 @@ resource "cloudflare_page_rule" "www" {
 - `api_base_path` (String) Configure the base path used by the API client. Alternatively, can be configured using the `CLOUDFLARE_API_BASE_PATH` environment variable.
 - `api_client_logging` (Boolean) Whether to print logs from the API client (using the default log library logger). Alternatively, can be configured using the `CLOUDFLARE_API_CLIENT_LOGGING` environment variable.
 - `api_hostname` (String) Configure the hostname used by the API client. Alternatively, can be configured using the `CLOUDFLARE_API_HOSTNAME` environment variable.
-- `api_key` (String) The API key for operations. Alternatively, can be configured using the `CLOUDFLARE_API_KEY` environment variable. API keys are [now considered legacy by Cloudflare](https://developers.cloudflare.com/api/keys/#limitations), API tokens should be used instead. Must provide only one of `api_key`, `api_token`.
-- `api_token` (String) The API Token for operations. Alternatively, can be configured using the `CLOUDFLARE_API_TOKEN` environment variable.
-- `api_user_service_key` (String) A special Cloudflare API key good for a restricted set of endpoints. Alternatively, can be configured using the `CLOUDFLARE_API_USER_SERVICE_KEY` environment variable.
+- `api_key` (String) The API key for operations. Alternatively, can be configured using the `CLOUDFLARE_API_KEY` environment variable. API keys are [now considered legacy by Cloudflare](https://developers.cloudflare.com/api/keys/#limitations), API tokens should be used instead. Must provide only one of `api_key`, `api_token`, `api_user_service_key`.
+- `api_token` (String) The API Token for operations. Alternatively, can be configured using the `CLOUDFLARE_API_TOKEN` environment variable. Must provide only one of `api_key`, `api_token`, `api_user_service_key`.
+- `api_user_service_key` (String) A special Cloudflare API key good for a restricted set of endpoints. Alternatively, can be configured using the `CLOUDFLARE_API_USER_SERVICE_KEY` environment variable. Must provide only one of `api_key`, `api_token`, `api_user_service_key`.
 - `email` (String) A registered Cloudflare email address. Alternatively, can be configured using the `CLOUDFLARE_EMAIL` environment variable. Required when using `api_key`. Conflicts with `api_token`.
 - `max_backoff` (Number) Maximum backoff period in seconds after failed API calls. Alternatively, can be configured using the `CLOUDFLARE_MAX_BACKOFF` environment variable.
 - `min_backoff` (Number) Minimum backoff period in seconds after failed API calls. Alternatively, can be configured using the `CLOUDFLARE_MIN_BACKOFF` environment variable.

internal/provider/provider.go

@@ -92,7 +92,7 @@ func New(version string) func() *schema.Provider {
 					Optional:     true,
 					DefaultFunc:  schema.EnvDefaultFunc("CLOUDFLARE_API_KEY", nil),
 					Description:  "The API key for operations. Alternatively, can be configured using the `CLOUDFLARE_API_KEY` environment variable. API keys are [now considered legacy by Cloudflare](https://developers.cloudflare.com/api/keys/#limitations), API tokens should be used instead.",
-					ExactlyOneOf: []string{"api_key", "api_token"},
+					ExactlyOneOf: []string{"api_key", "api_token", "api_user_service_key"},
 					ValidateFunc: validation.StringMatch(regexp.MustCompile("[0-9a-f]{37}"), "API key must only contain characters 0-9 and a-f (all lowercased)"),
 				},
 
@@ -101,14 +101,16 @@ func New(version string) func() *schema.Provider {
 					Optional:     true,
 					DefaultFunc:  schema.EnvDefaultFunc("CLOUDFLARE_API_TOKEN", nil),
 					Description:  "The API Token for operations. Alternatively, can be configured using the `CLOUDFLARE_API_TOKEN` environment variable.",
+					ExactlyOneOf: []string{"api_key", "api_token", "api_user_service_key"},
 					ValidateFunc: validation.StringMatch(regexp.MustCompile("[A-Za-z0-9-_]{40}"), "API tokens must only contain characters a-z, A-Z, 0-9, hyphens and underscores"),
 				},
 
 				"api_user_service_key": {
-					Type:        schema.TypeString,
-					Optional:    true,
-					DefaultFunc: schema.EnvDefaultFunc("CLOUDFLARE_API_USER_SERVICE_KEY", nil),
-					Description: "A special Cloudflare API key good for a restricted set of endpoints. Alternatively, can be configured using the `CLOUDFLARE_API_USER_SERVICE_KEY` environment variable.",
+					Type:         schema.TypeString,
+					Optional:     true,
+					DefaultFunc:  schema.EnvDefaultFunc("CLOUDFLARE_API_USER_SERVICE_KEY", nil),
+					ExactlyOneOf: []string{"api_key", "api_token", "api_user_service_key"},
+					Description:  "A special Cloudflare API key good for a restricted set of endpoints. Alternatively, can be configured using the `CLOUDFLARE_API_USER_SERVICE_KEY` environment variable.",
 				},
 
 				"rps": {
@@ -305,7 +307,9 @@ func configure(version string, p *schema.Provider) func(context.Context, *schema
 
 		if v, ok := d.GetOk("api_token"); ok {
 			config.APIToken = v.(string)
-		} else if v, ok := d.GetOk("api_key"); ok {
+		}
+
+		if v, ok := d.GetOk("api_key"); ok {
 			config.APIKey = v.(string)
 			if v, ok = d.GetOk("email"); ok {
 				config.Email = v.(string)
@@ -317,12 +321,6 @@ func configure(version string, p *schema.Provider) func(context.Context, *schema
 
 				return nil, diags
 			}
-		} else {
-			diags = append(diags, diag.Diagnostic{
-				Severity: diag.Error,
-				Summary:  "credentials are not set correctly",
-			})
-			return nil, diags
 		}
 
 		if v, ok := d.GetOk("api_user_service_key"); ok {