Cloudflare.LogsControl reference

CmbConfig

Source: src/Cloudflare/LogsControl/CmbConfig.ts

The account-level Customer Metadata Boundary (CMB) configuration for Cloudflare Logs (/accounts/{account_id}/logs/control/cmb/config).

The CMB config is a true account singleton with PUT/DELETE semantics: the POST endpoint is a full upsert, and DELETE removes the configuration entirely (an account with no CMB config reads back as empty). Identity is the account itself.

CMB is part of Cloudflare’s Data Localization Suite and requires an Enterprise plan — on unentitled accounts every operation fails with the typed LogsControlNotAuthorized error.

Changing the CMB region changes where ALL logs for the account are stored and processed, and deleting the config lifts the boundary. Handle with care in production accounts.

CmbConfig: Restricting logs to a region

Keep all account logs in the EU

const cmb = yield* Cloudflare.LogsControl.CmbConfig("EuLogs", {
  regions: "eu",
});

Allow out-of-region access

const cmb = yield* Cloudflare.LogsControl.CmbConfig("EuLogs", {
  regions: "eu",
  allowOutOfRegionAccess: true,
});

LogsRetentionFlag

Source: src/Cloudflare/LogsControl/RetentionFlag.ts

The zone-level Logpull retention flag (/zones/{zone_id}/logs/control/retention/flag) pinned to a desired value.

The flag is a singleton that always exists on every zone, so this resource never creates or deletes anything physical. Reconcile re-posts the flag when the observed value differs from the desired one; destroy restores the value the flag had before Alchemy first managed it (captured as initialFlag) — there is no DELETE endpoint.

Logpull is an Enterprise feature — on unentitled zones every operation fails with the typed LogsControlNotAuthorized error.

LogsRetentionFlag: Managing log retention

Enable Logpull retention on a zone

const retention = yield* Cloudflare.LogsControl.LogsRetentionFlag("Retention", {
  zoneId: zone.zoneId,
  flag: true,
});

Explicitly disable retention

yield* Cloudflare.LogsControl.LogsRetentionFlag("Retention", {
  zoneId: zone.zoneId,
  flag: false,
});