Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- cloudflare_ai_security enables AI Security for Apps for a zone; it does not create a blocking rule. Blocking or challenging requests requires an explicit rule and action.
- The Cloudflare Terraform provider supports the relevant resources from version 5.29.0. LLM endpoint discovery is available on all plans; detection fields and the AI Security Log Mode Ruleset are paid Enterprise add-ons whose eligibility should be confirmed with the account team.
- Detection scans application/json requests to endpoints labeled cf-llm, and the zone must have WAF enabled.
- cloudflare_ai_security_custom_topics owns the zone’s complete topic list, while custom rules belong in the zone’s existing single entry-point ruleset.
Turning on detection does not block prompts
Cloudflare announced Terraform support for AI Security for Apps on November 12, 2026. cloudflare_ai_security enables detection for a zone, but setting enabled = true does not create a custom rule that blocks prompts or choose a traffic action for you. Detection and enforcement are separate configuration steps.
When enabled and entitled, detection results are available to WAF rule expressions. You can review results in Security Analytics by filtering for the cf-llm label. To block or challenge requests, define a separate custom rule or rate-limiting rule with an explicit condition and action.
Check the provider version and account entitlement
Cloudflare Terraform provider 5.29.0 or later supports cloudflare_ai_security and cloudflare_ai_security_custom_topics. LLM endpoint discovery is available on Free, Pro, Business, and Enterprise plans. AI detection fields and the AI Security Log Mode Ruleset are listed as paid Enterprise add-ons.
Contact your Cloudflare account team to confirm access to detection fields or the Log Mode Ruleset for your account. The available source material does not establish public pricing, country or region availability, or entitlement for any particular account. Do not infer those details from Terraform configuration or a plan name alone.
Confirm that the traffic is in scope
AI Security for Apps scans requests to endpoints labeled cf-llm, and currently handles only the application/json content type. WAF must also be enabled on the zone for detection fields to be populated and usable in rule expressions.
Unlabeled endpoints and non-JSON requests are outside the documented scan scope. Enabling the resource does not cover every application request or guarantee that every prompt will be blocked. Check the target endpoint, content type, and zone WAF status first.
Manage custom topics as the complete zone list
cloudflare_ai_security_custom_topics manages the entire custom-topic list for a zone. A Terraform apply replaces the current list with the configured list, including topics previously added in the Cloudflare dashboard but not represented in Terraform.
Before applying, include every topic you intend to keep and review the planned list change. A custom-topic rule expression must use a label that exactly matches the topic’s label. If a label changes, check the corresponding rule expression too.
Merge blocking rules into the existing entry point
The example uses cloudflare_ruleset with kind = zone in the http_request_firewall_custom phase, with expressions that use AI detection fields such as cf.llm.prompt.pii_detected or cf.llm.prompt.custom_topic_categories. A detection field does not itself block traffic; the rule’s action determines whether to block or challenge.
Each zone has a single entry-point ruleset for custom rules. If Terraform already manages it, add the new rules to that existing cloudflare_ruleset instead of creating a second entry point. The example requires the Zone WAF Write API token permission; check that the token used for the change has it.
Review the plan, then check with synthetic traffic
Before a change, check the provider version, add-on entitlement, zone WAF status, cf-llm endpoint labels, and JSON requests. Inspect the current Terraform state, the complete custom-topic list, and whether an http_request_firewall_custom entry-point ruleset already exists.
Review the Terraform plan carefully: enabling detection should not be mistaken for creating a blocking rule; the topic resource replaces the full list; and new rules should be merged into the existing entry point. Review the diff and confirm Zone WAF Write permission before deciding whether to proceed under your change process.
If you need to check expression scope, use an isolated non-production zone and synthetic application/json requests containing fictional prompts only. Use those synthetic requests to review Security Analytics and the custom-rule behavior. Do not put real customer prompts, personal information, or credentials in request samples. This is a checklist; no Terraform plan or apply was run for any account, and no live configuration test is claimed here.
Treat full-request-body logging as a separate data decision
The AI Security Log Mode Ruleset logs the full request body alongside detection results. That includes more request content than the detection fields alone, so review whether it is necessary, who can access the logs, and the applicable data-handling and retention arrangements before enabling it.
Assess detection and request-body logging separately. If the current goal is an explicit blocking rule using detection fields, do not treat full-body logging as a default step. Confirm entitlement and data-handling boundaries first.
Sources
Frequently Asked Questions
Does detection work only with one LLM provider?
No. Cloudflare describes AI Security for Apps as model-agnostic, with detections that work regardless of the LLM used. The cf-llm label, application/json, WAF and account add-on requirements still apply.
Does a successful Terraform plan prove that prompts are blocked?
No. A plan describes proposed changes, not real request outcomes. Apply changes only through the approved process, then use isolated synthetic requests to confirm detection signals, matching rules and the actual action separately. Without those results, blocking remains unverified.