Adds validation to cloudflare_record to ensure TTL is not set while proxied is true

cloudflare/resource_cloudflare_record.go

@@ -321,6 +321,10 @@ func resourceCloudflareRecordCreate(d *schema.ResourceData, meta interface{}) er
 	}
 
 	if ttl, ok := d.GetOk("ttl"); ok {
+		if ttl.(int) != 1 && newRecord.Proxied {
+			return fmt.Errorf("error validating record %s: ttl cannot be set when `proxied` is true", newRecord.Name)
+		}
+
 		newRecord.TTL = ttl.(int)
 	}
 
@@ -437,6 +441,10 @@ func resourceCloudflareRecordUpdate(d *schema.ResourceData, meta interface{}) er
 	}
 
 	if ttl, ok := d.GetOk("ttl"); ok {
+		if ttl.(int) != 1 && updateRecord.Proxied {
+			return fmt.Errorf("error validating record %s: ttl cannot be set when `proxied` is true", updateRecord.Name)
+		}
+
 		updateRecord.TTL = ttl.(int)
 	}
 

cloudflare/resource_cloudflare_record_test.go

@@ -323,6 +323,49 @@ func TestAccCloudflareRecord_CreateAfterManualDestroy(t *testing.T) {
 	})
 }
 
+func TestAccCloudflareRecord_TtlValidation(t *testing.T) {
+	t.Parallel()
+	domain := os.Getenv("CLOUDFLARE_DOMAIN")
+	recordName := "tf-acctest-ttl-validation"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudflareRecordDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccCheckCloudflareRecordConfigTtlValidation(domain, recordName),
+				ExpectError: regexp.MustCompile(fmt.Sprintf("error validating record %s: ttl cannot be set when `proxied` is true", recordName)),
+			},
+		},
+	})
+}
+
+func TestAccCloudflareRecord_TtlValidationUpdate(t *testing.T) {
+	t.Parallel()
+	domain := os.Getenv("CLOUDFLARE_DOMAIN")
+	recordName := "tf-acctest-ttl-validation"
+	name := "cloudflare_record.foobar"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudflareRecordDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckCloudflareRecordConfigProxied(domain, recordName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudflareRecordExists(name, &cloudflare.DNSRecord{}),
+				),
+			},
+			{
+				Config:      testAccCheckCloudflareRecordConfigTtlValidation(domain, recordName),
+				ExpectError: regexp.MustCompile(fmt.Sprintf("error validating record %s: ttl cannot be set when `proxied` is true", recordName)),
+			},
+		},
+	})
+}
+
 func testAccCheckCloudflareRecordRecreated(before, after *cloudflare.DNSRecord) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if before.ID == after.ID {
@@ -550,3 +593,16 @@ resource "cloudflare_record" "foobar" {
 	ttl = 3600
 }`, zone, name)
 }
+
+func testAccCheckCloudflareRecordConfigTtlValidation(zone, name string) string {
+	return fmt.Sprintf(`
+resource "cloudflare_record" "foobar" {
+	domain = "%[1]s"
+
+	name = "%[2]s"
+	value = "%[1]s"
+	type = "CNAME"
+	proxied = true
+	ttl = 3600
+}`, zone, name)
+}