Update configure-https-settings.mdx (#24703)

* Update configure-https-settings.mdx

* Update src/content/docs/terraform/tutorial/configure-https-settings.mdx

Co-authored-by: Denise Peña <[email protected]>

---------

Co-authored-by: Denise Peña <[email protected]>

Author: Ashnayak

src/content/docs/terraform/tutorial/configure-https-settings.mdx

@@ -10,256 +10,105 @@ head:
 
 import { Render } from "~/components";
 
-After proxying a basic website through Cloudflare, you can use Terraform to adjust zone settings. In this tutorial, you will configure some optional HTTPS settings and then push the updated configuration to GitHub for posterity.
+After setting up basic DNS records, you can configure zone settings using Terraform. This tutorial shows how to enable [TLS 1.3](/ssl/edge-certificates/additional-options/tls-13/), [Automatic HTTPS Rewrites](/ssl/edge-certificates/additional-options/automatic-https-rewrites/), and [Strict SSL mode](/ssl/origin-configuration/ssl-modes/full-strict/) using the updated v5 provider.
 
-You will use a new Git branch for the changes and then merge it into the `master` branch before applying. On a team, you might consider using this step as an opportunity for others to review your change before merging and deploying it. You can also integrate Terraform into your CI/CD system to perform tests automatically using another Cloudflare domain.
+## Prerequisites
+- Completed tutorials [1](/terraform/tutorial/initialize-terraform/) and [2](/terraform/tutorial/track-history/)
+- Valid SSL certificate on your origin server (use the [Cloudflare Origin CA](/ssl/origin-configuration/origin-ca/) to generate one for strict SSL mode)
 
-<Render file="v4-code-snippets" product="terraform" />
+## 1. Create zone setting configuration
 
-## 1. Create a new branch and append the new zone settings
-
-In this step, modify the Terraform configuration to enable the following settings:
-
-- [TLS 1.3](/ssl/edge-certificates/additional-options/tls-13/)
-- [Automatic HTTPS Rewrites](/ssl/edge-certificates/additional-options/automatic-https-rewrites/)
-- [Strict SSL mode](/ssl/origin-configuration/ssl-modes/full-strict/)
-
-Strict mode requires a valid SSL certificate on your origin — use the [Cloudflare Origin CA](/ssl/origin-configuration/origin-ca/) to generate one.
+Create a new branch and add zone settings:
 
 ```bash
-git checkout -b step3-https
-```
-
-```sh output
-Switched to a new branch 'step3-https'
-```
-
-```sh
-cat >> cloudflare.tf <<'EOF'
+git checkout -b step3-zone-setings
+```
+Add the following to your `main.tf` file:
+```hcl
+# Enable TLS 1.3
+resource "cloudflare_zone_setting" "tls_1_3" {
+  zone_id    = var.zone_id
+  setting_id = "tls_1_3"
+  value      = "on"
+}
 
-resource "cloudflare_zone_settings_override" "example-com-settings" {
-  zone_id = var.zone_id
+# Enable automatic HTTPS rewrites
+resource "cloudflare_zone_setting" "automatic_https_rewrites" {
+  zone_id    = var.zone_id
+  setting_id = "automatic_https_rewrites"
+  value      = "on"
+}
 
-  settings {
-    tls_1_3                  = "on"
-    automatic_https_rewrites = "on"
-    ssl                      = "strict"
-  }
+# Set SSL mode to strict
+resource "cloudflare_zone_setting" "ssl" {
+  zone_id    = var.zone_id
+  setting_id = "ssl"
+  value      = "strict"
 }
-EOF
 ```
 
-## 2. Preview and merge the changes
+## 2. Preview and apply the changes
 
-Review what Terraform is proposing before applying changes. The example output below is being filtered to ignore computed values — in this case, settings that will keep their default values.
+Review the proposed changes:
 
 ```sh
-terraform plan | grep -v "(known after apply)"
+terraform plan
 ```
+Expected output
 
 ```sh output
-Refreshing Terraform state in-memory prior to plan...
-The refreshed state will be used to calculate this plan, but will not be
-persisted to local or remote state storage.
-
-cloudflare_record.www: Refreshing state... [id=c38d3103767284e7cd14d5dad3ab8668]
-
-------------------------------------------------------------------------
-
-An execution plan has been generated and is shown below.
-Resource actions are indicated with the following symbols:
-  + create
+Plan: 3 to add, 0 to change, 0 to destroy.
 
 Terraform will perform the following actions:
 
-  # cloudflare_zone_settings_override.example-com-settings will be created
-  + resource "cloudflare_zone_settings_override" "example-com-settings" {
-      + zone_id                  = "<ZONE_ID>"
-
-      + settings {
-        + automatic_https_rewrites    = "on"
-        + ssl                         = "strict"
-        + tls_1_3                     = "on"
-
-        # (...)
-      }
-  }
-
-Plan: 1 to add, 0 to change, 0 to destroy.
-
-------------------------------------------------------------------------
-
-Note: You didn't use the -out option to save this plan, so Terraform can't
-guarantee to take exactly these actions if you run "terraform apply" now.
-```
-
-The proposed changes look good, so you can merge them into the `master` branch and then apply them with `terraform apply`. When working on a team, you may want to require pull requests and use this opportunity to peer review any proposed configuration changes.
-
-```sh
-git add cloudflare.tf
-git commit -m "Step 3 - Enable TLS 1.3, Always Use HTTPS, and SSL Strict mode."
-```
-
-```sh output
-[step3-https d540600] Step 3 - Enable TLS 1.3, Always Use HTTPS, and SSL Strict mode.
- 1 file changed, 11 insertions(+)
-```
-
-```sh
-git checkout master
-```
-
-```sh output
-Switched to branch 'master'
-```
+  # cloudflare_zone_setting.automatic_https_rewrites will be created
+  + resource "cloudflare_zone_setting" "automatic_https_rewrites" {
+      + setting_id = "automatic_https_rewrites"
+      + value      = "on"
+      + zone_id    = "your-zone-id"
+    }
 
-```sh
-git merge step3-https
-```
+  # cloudflare_zone_setting.ssl will be created
+  + resource "cloudflare_zone_setting" "ssl" {
+      + setting_id = "ssl"
+      + value      = "strict"
+      + zone_id    = "your-zone-id"
+    }
 
-```sh output
-Updating d26f40b..d540600
-Fast-forward
- cloudflare.tf | 11 +++++++++++
- 1 file changed, 11 insertions(+)
+  # cloudflare_zone_setting.tls_1_3 will be created
+  + resource "cloudflare_zone_setting" "tls_1_3" {
+      + setting_id = "tls_1_3"
+      + value      = "on"
+      + zone_id    = "your-zone-id"
+    }
 ```
+Commit and merge the changes:
 
-```sh
+```bash
+git add main.tf
+git commit -m "Enable TLS 1.3, automatic HTTPS rewrites, and strict SSL"
+git checkout main
+git merge step3-zone-settings
 git push
 ```
-
-```sh output
-Counting objects: 3, done.
-Delta compression using up to 8 threads.
-Compressing objects: 100% (3/3), done.
-Writing objects: 100% (3/3), 501 bytes | 0 bytes/s, done.
-Total 3 (delta 1), reused 0 (delta 0)
-remote: Resolving deltas: 100% (1/1), completed with 1 local object.
-To [email protected]:$GITHUB_USER/cf-config.git
-   d26f40b..d540600  master -> master
-```
-
-## 3. Apply and verify the changes
-
 Before applying the changes, try to connect with TLS 1.3. Technically, you should not be able to with default settings. To follow along with this test, you will need to [compile `curl` against BoringSSL](https://everything.curl.dev/source/build/tls/boringssl#build-boringssl).
 
 ```sh
 curl -v --tlsv1.3 https://www.example.com 2>&1 | grep "SSL connection\|error"
 ```
-
-```sh output
-* error:1000042e:SSL routines:OPENSSL_internal:TLSV1_ALERT_PROTOCOL_VERSION
-curl: (35) error:1000042e:SSL routines:OPENSSL_internal:TLSV1_ALERT_PROTOCOL_VERSION
-```
-
 As shown above, you should receive an error because TLS 1.3 is not yet enabled on your zone. Enable it by running `terraform apply` and try again.
 
-```sh
-terraform apply --auto-approve
-```
-
-```sh output
-
-Terraform used the selected providers to generate the following execution plan.
-Resource actions are indicated with the following symbols:
-  + create
-
-Terraform will perform the following actions:
-
-  # cloudflare_zone_settings_override.example-com-settings will be created
-  + resource "cloudflare_zone_settings_override" "example-com-settings" {
-      + id                       = (known after apply)
-      + initial_settings         = (known after apply)
-      + initial_settings_read_at = (known after apply)
-      + readonly_settings        = (known after apply)
-      + zone_id                  = "e2e6491340be87a3726f91fc4148b126"
-      + zone_status              = (known after apply)
-      + zone_type                = (known after apply)
+Apply the configuration:
 
-      + settings {
-          + always_online               = (known after apply)
-          + always_use_https            = (known after apply)
-          + automatic_https_rewrites    = "on"
-          + binary_ast                  = (known after apply)
-          + brotli                      = (known after apply)
-          + browser_cache_ttl           = (known after apply)
-          + browser_check               = (known after apply)
-          + cache_level                 = (known after apply)
-          + challenge_ttl               = (known after apply)
-          + ciphers                     = (known after apply)
-          + cname_flattening            = (known after apply)
-          + development_mode            = (known after apply)
-          + early_hints                 = (known after apply)
-          + email_obfuscation           = (known after apply)
-          + filter_logs_to_cloudflare   = (known after apply)
-          + h2_prioritization           = (known after apply)
-          + hotlink_protection          = (known after apply)
-          + http2                       = (known after apply)
-          + http3                       = (known after apply)
-          + image_resizing              = (known after apply)
-          + ip_geolocation              = (known after apply)
-          + ipv6                        = (known after apply)
-          + log_to_cloudflare           = (known after apply)
-          + max_upload                  = (known after apply)
-          + min_tls_version             = (known after apply)
-          + mirage                      = (known after apply)
-          + opportunistic_encryption    = (known after apply)
-          + opportunistic_onion         = (known after apply)
-          + orange_to_orange            = (known after apply)
-          + origin_error_page_pass_thru = (known after apply)
-          + origin_max_http_version     = (known after apply)
-          + polish                      = (known after apply)
-          + prefetch_preload            = (known after apply)
-          + privacy_pass                = (known after apply)
-          + proxy_read_timeout          = (known after apply)
-          + pseudo_ipv4                 = (known after apply)
-          + response_buffering          = (known after apply)
-          + rocket_loader               = (known after apply)
-          + security_level              = (known after apply)
-          + server_side_exclude         = (known after apply)
-          + sort_query_string_for_cache = (known after apply)
-          + ssl                         = "strict"
-          + tls_1_2_only                = (known after apply)
-          + tls_1_3                     = "on"
-          + tls_client_auth             = (known after apply)
-          + true_client_ip_header       = (known after apply)
-          + universal_ssl               = (known after apply)
-          + visitor_ip                  = (known after apply)
-          + waf                         = (known after apply)
-          + webp                        = (known after apply)
-          + websockets                  = (known after apply)
-          + zero_rtt                    = (known after apply)
-
-          + mobile_redirect {
-              + mobile_subdomain = (known after apply)
-              + status           = (known after apply)
-              + strip_uri        = (known after apply)
-            }
-
-          + security_header {
-              + enabled            = (known after apply)
-              + include_subdomains = (known after apply)
-              + max_age            = (known after apply)
-              + nosniff            = (known after apply)
-              + preload            = (known after apply)
-            }
-        }
-    }
-
-Plan: 1 to add, 0 to change, 0 to destroy.
-cloudflare_zone_settings_override.example-com-settings: Creating...
-cloudflare_zone_settings_override.example-com-settings: Still creating... [10s elapsed]
-cloudflare_zone_settings_override.example-com-settings: Creation complete after 14s [id=e2e6491340be87a3726f91fc4148b126]
-
-Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
+```sh
+terraform apply
 ```
+Type `yes` when prompted.
 
+## 3. Verify the settings
 Try the same command as before. The command will now succeed.
 
 ```sh
 curl -v --tlsv1.3 https://www.example.com 2>&1 | grep "SSL connection\|error"
 ```
 
-```sh output
-* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256
-```