Cloudflare.ResourceSharing reference

Share

Source: packages/cloudflare/src/ResourceSharing/Share.ts

A Cloudflare resource share — shares account-level configuration (gateway policies, custom rulesets, IdP federation grants, …) with another account or organization.

The create API requires at least one recipient and one resource, so both are seeded inline. Post-create changes to those arrays are reconciled through the recipient/resource sub-APIs; only name is mutable on the share itself. Deletion is asynchronous (active → deleting → deleted).

Share: Creating a Share

const policy = yield* Cloudflare.Gateway.Rule("BlockPhishing", {
  action: "block",
  traffic: 'dns.fqdn == "phishing.example"',
  filters: ["dns"],
});

const share = yield* Cloudflare.ResourceSharing.Share("PolicyShare", {
  recipients: [{ accountId: "<recipient-account-id>" }],
  resources: [
    { resourceType: "gateway-policy", resourceId: policy.ruleId },
  ],
});

Share: Updating a Share

const share = yield* Cloudflare.ResourceSharing.Share("PolicyShare", {
  name: "security-baseline-v2",
  recipients: [{ accountId: "<recipient-account-id>" }],
  resources: [
    { resourceType: "gateway-policy", resourceId: policy.ruleId },
  ],
});

Share: Looking up an existing share

Share.lookup references a share this account sent that Alchemy doesn’t manage (created in the dashboard or by another stack), found by shareId or name. It is read during plan/deploy and never created, updated or deleted.

const share = Cloudflare.ResourceSharing.Share.lookup({ name: "security-baseline" });
yield* Cloudflare.ResourceSharing.ShareRecipient("Partner", {
  shareId: share.shareId,
  accountId: "<recipient-account-id>",
});

ShareRecipient

Source: packages/cloudflare/src/ResourceSharing/ShareRecipient.ts

A recipient on an existing Cloudflare share — grants another account or organization access to the share’s resources.

This is an existence-only resource: there is no update API, so every prop change triggers a replacement. Association is eventually consistent (associating → associated). Do not manage the same recipient both inline on Share.recipients and through this resource.

ShareRecipient: Adding a Recipient

Share with another account

const recipient = yield* Cloudflare.ResourceSharing.ShareRecipient("Partner", {
  shareId: share.shareId,
  accountId: "<recipient-account-id>",
});

Share with an organization

const recipient = yield* Cloudflare.ResourceSharing.ShareRecipient("Org", {
  shareId: share.shareId,
  organizationId: "<recipient-organization-id>",
});

ShareResource

Source: packages/cloudflare/src/ResourceSharing/ShareResource.ts

A resource entry on an existing Cloudflare share — adds a shareable resource (gateway policy, custom ruleset, …) to a Share incrementally.

Only meta is mutable in place; changing the share, type, id, or owning account triggers a replacement. A share must always retain at least one resource — the last entry cannot be deleted (delete the Share instead). Do not manage the same entry both inline on Share.resources and through this resource.

ShareResource: Adding a Resource to a Share

const entry = yield* Cloudflare.ResourceSharing.ShareResource("ExtraPolicy", {
  shareId: share.shareId,
  resourceType: "gateway-policy",
  resourceId: policy.ruleId,
});

ShareResource: Updating Metadata

const entry = yield* Cloudflare.ResourceSharing.ShareResource("ExtraPolicy", {
  shareId: share.shareId,
  resourceType: "gateway-policy",
  resourceId: policy.ruleId,
  meta: { note: "rotated" },
});