Check out my Terraform module for managing Access policies as code.

So you're managing Access policies with Terraform. Good start, but you've only solved half the problem.

The official Cloudflare provider has critical gaps the vendor doesn't highlight:
* No state import for existing Access applications or policies. Hope you didn't have a pilot project first.
* Zero-drift detection is a fantasy. Change a single `allowed_idps` and it wants to replace the entire policy.
* Managing service tokens as code? Build your own system. The provider offers nothing.

You're just automating the creation of a future migration headache. The real cost is the manual reconciliation you'll do every quarter when the state file drifts from reality.