From 7a64c072876bd2f6544767adadbc1fb4f16a8b78 Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Wed, 15 Apr 2026 12:09:39 +0200 Subject: [PATCH] docs(cloudflare): document API Key requirement for api_token_ip_restriction_enabled check --- .../providers/cloudflare/authentication.mdx | 12 ++++++++++++ .../api_token_ip_restriction_enabled.metadata.json | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/providers/cloudflare/authentication.mdx b/docs/user-guide/providers/cloudflare/authentication.mdx index eedcd57a33..db62e84d0c 100644 --- a/docs/user-guide/providers/cloudflare/authentication.mdx +++ b/docs/user-guide/providers/cloudflare/authentication.mdx @@ -30,6 +30,18 @@ Prowler requires read-only access to Cloudflare zones and their settings. The fo Ensure the API Token has access to all zones targeted for scanning. Missing permissions may cause some checks to fail or return incomplete results. +### Checks Requiring API Key and Email Authentication + +Some Cloudflare API endpoints are restricted to user-level authentication and cannot be accessed with scoped API Tokens. The following checks require [API Key and Email](#api-key-and-email-legacy) authentication: + +| Check | Description | +|-------|-------------| +| `api_token_ip_restriction_enabled` | Verifies that API tokens have client IP address filtering configured | + + +When using API Token authentication, these checks are automatically skipped without affecting the rest of the scan. + + --- ## API Token (Recommended) diff --git a/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json b/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json index cdc3e0c9f8..94f0ca6ef0 100644 --- a/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json +++ b/prowler/providers/cloudflare/services/api/api_token_ip_restriction_enabled/api_token_ip_restriction_enabled.metadata.json @@ -32,5 +32,5 @@ ], "DependsOn": [], "RelatedTo": [], - "Notes": "API tokens can have both allow lists and deny lists for IP filtering." + "Notes": "API tokens can have both allow lists and deny lists for IP filtering. This check requires API Key and Email authentication because the Cloudflare API does not expose user token listing to scoped API Tokens." }