diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 9a7d509009..991ac60a0b 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -2,6 +2,14 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.24.1] (Prowler UNRELEASED) + +### 🐞 Fixed + +- Cloudflare account-scoped API tokens failing connection test in the App with `CloudflareUserTokenRequiredError` [(#10723)](https://github.com/prowler-cloud/prowler/pull/10723) + +--- + ## [5.24.0] (Prowler v5.24.0) ### 🚀 Added diff --git a/prowler/providers/cloudflare/cloudflare_provider.py b/prowler/providers/cloudflare/cloudflare_provider.py index 35dd88ef76..35067c30d8 100644 --- a/prowler/providers/cloudflare/cloudflare_provider.py +++ b/prowler/providers/cloudflare/cloudflare_provider.py @@ -332,19 +332,16 @@ class CloudflareProvider(Provider): return except PermissionDeniedError as error: error_str = str(error) - # Check for user-level authentication required (code 9109) - if "9109" in error_str: - logger.error(f"CloudflareUserTokenRequiredError: {error}") - raise CloudflareUserTokenRequiredError( - file=os.path.basename(__file__), - ) # Check for invalid API key or email (code 9103) - comes as 403 if "9103" in error_str or "Unknown X-Auth-Key" in error_str: logger.error(f"CloudflareInvalidAPIKeyError: {error}") raise CloudflareInvalidAPIKeyError( file=os.path.basename(__file__), ) - # For other permission errors, try accounts.list() as fallback + # For permission errors (including 9109 account-scoped tokens), + # try accounts.list() as fallback before failing. + # Error 9109 means the token is account-scoped, not user-level, + # which is valid for scanning — only fail if accounts.list() also fails. logger.warning( f"Unable to retrieve Cloudflare user info: {error}. " "Trying accounts.list() as fallback."