pruneops_cloud_account (Resource)

A cloud account PruneOps collects inventory, metrics and costs from (AWS account, OVH project, Cloudflare account…). Which providers exist, their regions and credential fields: the pruneops_providers data source.

Example Usage

# A regional provider: regions are required.
resource "pruneops_cloud_account" "aws_prod" {
  name        = "AWS production"
  provider_id = "aws"
  regions     = ["eu-west-1", "eu-south-2"]

  settings = {
    aws_account_id = "123456789012"
  }

  # Write-only: never stored in the Terraform state.
  credentials_wo = {
    access_key_id     = var.aws_access_key_id
    secret_access_key = var.aws_secret_access_key
  }
  # Bump to send new credentials (rotation).
  credentials_wo_version = 1
}

# A global provider: no regions.
resource "pruneops_cloud_account" "cloudflare" {
  name        = "Cloudflare"
  provider_id = "cloudflare"

  credentials_wo = {
    api_token  = var.cloudflare_token
    account_id = var.cloudflare_account_id
  }
  credentials_wo_version = 1
}

Schema

Required

• name (String) Display name.
• provider_id (String) Provider key, e.g. aws, ovh, hetzner, cloudflare. Changing it replaces the account.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• credentials_wo (Map of String, Sensitive, Write-only) Credentials, e.g. access_key_id and secret_access_key for AWS. Write-only: never stored in the Terraform state (needs Terraform 1.11+). Sent on create and whenever credentials_wo_version changes.
• credentials_wo_version (Number) Bump it to send credentials_wo again (rotation): Terraform cannot diff write-only values.
• is_active (Boolean) Whether PruneOps collects this account. Active accounts count towards the plan quota.
• regions (Set of String) Regions to collect. Required by regional providers; leave it out for global ones (Cloudflare, PostHog…), which PruneOps sets to ["global"].
• settings (Map of String) Non-secret provider fields of the credentials form, e.g. aws_account_id and parent_account_id for AWS, verify_ssl = "on" for Proxmox. Not read back from PruneOps.

Read-Only

• credential_keys (Set of String) Credential fields stored in PruneOps (names only, never values).
• credentials_verified_at (String) Last time PruneOps' connection test passed with the stored credentials.
• id (String) Account id, generated by PruneOps.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The account id (Organization → Integrations → Cloud Accounts, or the
# pruneops_cloud_accounts data source). The next apply sends settings and
# credentials_wo from the configuration.
terraform import pruneops_cloud_account.aws_prod 6ae73542f34b47ceab99e2830a0244c8