diff --git a/docs/user-guide/providers/cloudflare/authentication.mdx b/docs/user-guide/providers/cloudflare/authentication.mdx index eedcd57a33..db62e84d0c 100644 --- a/docs/user-guide/providers/cloudflare/authentication.mdx +++ b/docs/user-guide/providers/cloudflare/authentication.mdx @@ -30,6 +30,18 @@ Prowler requires read-only access to Cloudflare zones and their settings. The fo Ensure the API Token has access to all zones targeted for scanning. Missing permissions may cause some checks to fail or return incomplete results. +### Checks Requiring API Key and Email Authentication + +Some Cloudflare API endpoints are restricted to user-level authentication and cannot be accessed with scoped API Tokens. The following checks require [API Key and Email](#api-key-and-email-legacy) authentication: + +| Check | Description | +|-------|-------------| +| `api_token_ip_restriction_enabled` | Verifies that API tokens have client IP address filtering configured | + + +When using API Token authentication, these checks are automatically skipped without affecting the rest of the scan. + + --- ## API Token (Recommended) diff --git a/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json b/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json index cdc3e0c9f8..94f0ca6ef0 100644 --- a/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json +++ b/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json @@ -32,5 +32,5 @@ ], "DependsOn": [], "RelatedTo": [], - "Notes": "API tokens can have both allow lists and deny lists for IP filtering." + "Notes": "API tokens can have both allow lists and deny lists for IP filtering. This check requires API Key and Email authentication because the Cloudflare API does not expose user token listing to scoped API Tokens." }