Getting started

You need Terraform 1.11 or later (credentials are write-only arguments) and an owner or admin role in a PruneOps organization.

1. Create an API token

In PruneOps, go to Organization → Integrations → API Tokens and create a token. Tick Write for what Terraform will manage — Cloud accounts and, if you use it, Terraform state — and copy the token: it is shown only once.

The token belongs to one organization: Terraform manages the organization it was created in.

export PRUNEOPS_API_TOKEN="<token>"

Or pass it to the provider, e.g. kept in AWS SSM Parameter Store. An ephemeral resource keeps it out of the state and the plan:

ephemeral "aws_ssm_parameter" "pruneops_token" {
  arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/pruneops/api_token"
}

provider "pruneops" {
  api_token = ephemeral.aws_ssm_parameter.pruneops_token.value
}

2. Configure the provider

terraform {
  required_version = ">= 1.11"
  required_providers {
    pruneops = {
      source  = "registry.pruneops.run/pruneops/pruneops"
      version = "~> 0.1"
    }
  }
}

provider "pruneops" {}

terraform init downloads the provider from registry.pruneops.run and checks its signature.

3. Connect a cloud account

Which provider_ids exist, their regions and credential fields are listed by the pruneops_providers data source and in each provider's setup page of the PruneOps documentation.

resource "pruneops_cloud_account" "aws_prod" {
  name        = "AWS production"
  provider_id = "aws"
  regions     = ["eu-west-1", "eu-south-2"]

  settings = {
    aws_account_id = "123456789012"
  }

  credentials_wo = {
    access_key_id     = var.aws_access_key_id
    secret_access_key = var.aws_secret_access_key
  }
  credentials_wo_version = 1
}

terraform apply creates the account and PruneOps tests the connection: if it fails, the apply still succeeds and shows the provider's error as a warning, so you can fix the permissions and apply again.

Rotating credentials

Terraform cannot see changes in write-only values. To send new credentials, change credentials_wo and bump credentials_wo_version.

4. Decide what is tracked

resource "pruneops_cloud_account_resource_policy" "aws_prod" {
  account_id = pruneops_cloud_account.aws_prod.id

  track_all = true
  tracking_exclude_rules = [
    { tag_key = "env", tag_value = "dev" },
  ]
}

Without it, the account follows the organization's policy.