diff --git a/cloudflare/resource_cloudflare_access_group_test.go b/cloudflare/resource_cloudflare_access_group_test.go
index 1bfc1c9dd5..6b888ddc1f 100644
--- a/cloudflare/resource_cloudflare_access_group_test.go
+++ b/cloudflare/resource_cloudflare_access_group_test.go
@@ -35,7 +35,7 @@ func TestAccCloudflareAccessGroupConfig_Basic(t *testing.T) {
 					testAccCheckCloudflareAccessGroupExists(name, &accessGroup),
 					resource.TestCheckResourceAttr(name, "account_id", accountID),
 					resource.TestCheckResourceAttr(name, "name", resourceName),
-					resource.TestCheckResourceAttr(name, "include.email", email),
+					resource.TestCheckResourceAttr(name, "include.0.email.0", email),
 				),
 			},
 		},
@@ -60,8 +60,8 @@ func TestAccCloudflareAccessGroup_Exclude(t *testing.T) {
 					testAccCheckCloudflareAccessGroupExists(name, &accessGroup),
 					resource.TestCheckResourceAttr(name, "account_id", accountID),
 					resource.TestCheckResourceAttr(name, "name", resourceName),
-					resource.TestCheckResourceAttr(name, "include.email", email),
-					resource.TestCheckResourceAttr(name, "exclude.email", email),
+					resource.TestCheckResourceAttr(name, "include.0.email.0", email),
+					resource.TestCheckResourceAttr(name, "exclude.0.email.0", email),
 				),
 			},
 		},
@@ -86,8 +86,8 @@ func TestAccCloudflareAccessGroup_Require(t *testing.T) {
 					testAccCheckCloudflareAccessGroupExists(name, &accessGroup),
 					resource.TestCheckResourceAttr(name, "account_id", accountID),
 					resource.TestCheckResourceAttr(name, "name", resourceName),
-					resource.TestCheckResourceAttr(name, "include.email", email),
-					resource.TestCheckResourceAttr(name, "require.email", email),
+					resource.TestCheckResourceAttr(name, "include.0.email.0", email),
+					resource.TestCheckResourceAttr(name, "require.0.email.0", email),
 				),
 			},
 		},
@@ -112,9 +112,9 @@ func TestAccCloudflareAccessGroup_FullConfig(t *testing.T) {
 					testAccCheckCloudflareAccessGroupExists(name, &accessGroup),
 					resource.TestCheckResourceAttr(name, "account_id", accountID),
 					resource.TestCheckResourceAttr(name, "name", resourceName),
-					resource.TestCheckResourceAttr(name, "include.email", email),
-					resource.TestCheckResourceAttr(name, "exclude.email", email),
-					resource.TestCheckResourceAttr(name, "require.email", email),
+					resource.TestCheckResourceAttr(name, "include.0.email.0", email),
+					resource.TestCheckResourceAttr(name, "exclude.0.email.0", email),
+					resource.TestCheckResourceAttr(name, "require.0.email.0", email),
 				),
 			},
 		},
@@ -146,7 +146,7 @@ func TestAccCloudflareAccessGroup_Updated(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCloudflareAccessGroupExists("cloudflare_access_group.test", &after),
 					testAccCheckCloudflareAccessGroupIDUnchanged(&before, &after),
-					resource.TestCheckResourceAttr(name, "include.email", "test-changed@example.com"),
+					resource.TestCheckResourceAttr(name, "include.0.email.0", "test-changed@example.com"),
 				),
 			},
 		},
@@ -186,11 +186,11 @@ func TestAccCloudflareAccessGroup_CreateAfterManualDestroy(t *testing.T) {
 					resource.TestCheckResourceAttr(
 						"cloudflare_access_group.test", "name", fmt.Sprintf("%s/updated", name)),
 					resource.TestCheckResourceAttr(
-						"cloudflare_access_group.test", "include.email", email),
+						"cloudflare_access_group.test", "include.0.email.0", email),
 					resource.TestCheckResourceAttr(
-						"cloudflare_access_group.test", "exclude.email", email),
+						"cloudflare_access_group.test", "exclude.0.email.0", email),
 					resource.TestCheckResourceAttr(
-						"cloudflare_access_group.test", "require.email", email),
+						"cloudflare_access_group.test", "require.0.email.0", email),
 				),
 			},
 		},