Try with v5 cloudflare provider

Author: Cyb3r-Jak3

.github/testing/main.tf

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = ">= 4.7.0"
+      version = ">= 5, <6"
     }
     random = {
       source  = "hashicorp/random"
-      version = "3.5.1"
+      version = "3.7.1"
     }
   }
 }
@@ -66,8 +66,6 @@ module "r2-api-token_wildcard" {
   expires_on = timeadd(timestamp(), "10m")
 }
 
-
-
 module "r2-api-token_eu" {
   source       = "../.."
   account_id   = var.account_id

.terraform.lock.hcl

@@ -3,12 +3,12 @@ terraform {
   required_providers {
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = ">= 4.13.0, <5"
+      version = ">= 5, <6"
     }
   }
 }
 
-data "cloudflare_api_token_permission_groups" "this" {}
+data "cloudflare_account_api_token_permission_groups" "this" {}
 
 locals {
   resources          = length(var.buckets) > 0 ? { for bucket in var.buckets : "com.cloudflare.edge.r2.bucket.${var.account_id}_${var.jurisdiction}_${bucket}" => "*" } : { "com.cloudflare.edge.r2.bucket.*" = "*" }
@@ -17,17 +17,18 @@ locals {
 
 resource "cloudflare_api_token" "token" {
   name = var.token_name != "" ? var.token_name : "R2-${local.token_bucket_names}-${var.bucket_read ? "Read" : ""}-${var.bucket_write ? "Write" : ""}"
-  policy {
+  polices = [{
+    effect = "allow"
+    resources = local.resources
     permission_groups = compact([
-      var.bucket_read ? data.cloudflare_api_token_permission_groups.this.r2["Workers R2 Storage Bucket Item Read"] : null,
-      var.bucket_write ? data.cloudflare_api_token_permission_groups.this.r2["Workers R2 Storage Bucket Item Write"] : null,
+      var.bucket_read ? data.cloudflare_account_api_token_permission_groups.this.r2["Workers R2 Storage Bucket Item Read"] : null,
+      var.bucket_write ? data.cloudflare_account_api_token_permission_groups.this.r2["Workers R2 Storage Bucket Item Write"] : null,
     ])
-    resources = local.resources
-  }
+  }]
   not_before = var.not_before != "" ? var.not_before : null
   expires_on = var.expires_on != "" ? var.expires_on : null
-  condition {
-    request_ip {
+  condition = {
+    request_ip = {
       in     = var.condition_ip_in
       not_in = var.condition_ip_not_in
     }