The actual timeline, staged over 19 months
This deprecation didn’t happen on one date. Cloudflare rolled it out in four distinct stages:
- December 2024: creating new
audit_sshrules through the dashboard disabled. - 2025-11-03: creating new rules through the API and Terraform disabled.
- 2026-01-15: editing existing rules disabled across dashboard, API, and Terraform alike.
- 2026-07-15: every remaining
audit_sshrule stops working entirely.
For a policy-as-code pipeline that only creates or edits Gateway rules occasionally, this staged rollout means a terraform apply could have started failing on the 2025-11-03 or 2026-01-15 cutoff, months before the feature actually stopped functioning at runtime on 2026-07-15. Three separate dates, three separate places automation could have quietly broken.
Structural Comparison Matrix
| Stage | What stopped | Date |
|---|---|---|
| New rules, dashboard | Creating audit_ssh rules by hand | December 2024 |
| New rules, API/Terraform | Creating audit_ssh rules programmatically | 2025-11-03 |
| Editing existing rules | Any update, any interface | 2026-01-15 |
| Runtime enforcement | Existing rules stop applying at all | 2026-07-15 |
Fix it: migrate to Access for Infrastructure
grep -rln "audit_ssh" --include="*.tf" .Cloudflare’s stated replacement is SSH with Access for Infrastructure, described as providing deeper functionality than the old Gateway network policy action rather than being a like-for-like field rename. Treat this as a genuine migration to a different feature area, not a config tweak: any Terraform module referencing audit_ssh needs its resource block replaced with the Access for Infrastructure equivalent, not just a renamed action string.
Check for a stale Terraform state, not just live rules
If Terraform stopped being able to apply changes to an audit_ssh rule back
on 2026-01-15, the resource may still exist in state without matching what the
dashboard or API currently reports. Run a plan against current state before
assuming Terraform’s view of these rules is accurate.
Confirmed version
Sourced from Cloudflare Community’s mirror of the official Gateway changelog announcement and Cloudflare’s own staged-deprecation timeline, full removal confirmed for 2026-07-15. This entry’s own changelog corroboration in Cloudflare’s API deprecations data was published 2026-05-13, ahead of the final cutoff. Browse more posts like this in the Data Automation archive.
