Getting "Resource instance managed by newer provider version" while using latest provider version

Terraform
1

I want to upgrade a TF state for cloudflare from provider version ~4 to version ~5 and from TF 1.8.5 to 1.13.5.

The upgrade appears to be successful, but now, when I execute terraform plan, I am getting the message:

│ Error: Resource instance managed by newer provider version
│
│ The current state of module.cloudflare_ipa_waf_rules["development-001"].cloudflare_ruleset.zone_level_waf_custom_ruleset was created by a newer provider version than is currently selected. Upgrade the cloudflare provider to work with this state.

The objects causing issues are of the type cloudflare_ruleset. In the verbose log, I am seeing:

2025-11-11T14:11:51.175+0100 [TRACE] upgradeResourceState: can't downgrade state for module.cloudflare_ipa_waf_rules["development-001"].cloudflare_ruleset.zone_level_waf_custom_ruleset from version 1 to 0

Am I missing something here? If I have upgraded the state and I am on a current TF and provider version, why might I get this error? The message implies that I must be using an older version than the state, but it’s actually the other way round.

Not sure if this is related, but the remote state (in S3) is still showing the previously used TF version. Should this already change in the remote state after executing terraform init -upgradeor only after the next apply?

2

Hi @wollo77,

A schema version can only ever increase, so if the provider inadvertently changed the version back to 0, you should file an issue with the provider.

3

Indeed, in version 4 of the provider the schema version of this resource type is set to 1:

It seems that for v5 the provider developers switched to an approach of generating the schema automatically based on OpenAPI definitions, but the new auto-generated version of that schema doesn’t set Version and so has effectively set version back to zero again:

Some similar challenges were reported for other resource types, though I couldn’t find an existing one for cloudflare_ruleset in particular:

Unless the provider devs make a new release with the schema version number set back to 1, I think the only immediate path to resolve this would be to use terraform state rm to remove the affected objects from the state and then use terraform import to reimport them using the latest version of the provider, at which point the imported objects should use the current version 0.

4

That is essentially what I had expected, thanks for the confirmation.

I have opened a support ticket with cloudflare and reported this as a bug, let’s hope this will be fixed.

5

Cool! Just for the sake of making this discoverable for someone who might find this discussion thread in future, the relevant issue in the provider repository is here: