Skip to content

pruneops_cloud_account_resource_policy (Resource)

A cloud account's resource policy: what is inventoried and what is tracked, overriding the organization's policy as a whole for this account. Destroying it falls back to the organization's.

Example Usage

resource "pruneops_cloud_account_resource_policy" "aws_prod" {
  account_id = pruneops_cloud_account.aws_prod.id

  # Never inventory Helm release secrets.
  inventory_exclude_rules = [
    { resource_type = "k8s:secret", name = "sh.helm.release.v1.*" },
  ]

  # Track everything except what is tagged env=dev.
  track_all = true
  tracking_exclude_rules = [
    { tag_key = "env", tag_value = "dev" },
  ]
}

Schema

Required

  • account_id (String) The pruneops_cloud_account id.

Optional

  • inventory_exclude_rules (Attributes List) Resources never inventoried (everything else is). Within a rule every set field must match (AND); any rule matching is enough (OR). A rule needs resource_type, name, tag_key or metadata_key. Values are case-insensitive and must be written lowercase. (see below for nested schema)
  • track_all (Boolean) Track every inventoried resource (tracking_exclude_rules still win).
  • tracking_exclude_rules (Attributes List) Resources never tracked, whatever track_all and tracking_rules say. Within a rule every set field must match (AND); any rule matching is enough (OR). A rule needs resource_type, name, tag_key or metadata_key. Values are case-insensitive and must be written lowercase. (see below for nested schema)
  • tracking_rules (Attributes List) Resources tracked (cost and usage). Within a rule every set field must match (AND); any rule matching is enough (OR). A rule needs resource_type, name, tag_key or metadata_key. Values are case-insensitive and must be written lowercase. (see below for nested schema)

Nested Schema for inventory_exclude_rules

Optional:

  • metadata_key (String) Metadata key the resource must carry.
  • metadata_value (String) Value of metadata_key; empty (or *) means any value.
  • name (String) Resource name, glob with * (e.g. sh.helm.release.v1.*).
  • resource_type (String) Resource type, exact match (e.g. ec2:instance).
  • tag_key (String) Tag the resource must carry.
  • tag_value (String) Value of tag_key; empty (or *) means any value.

Nested Schema for tracking_exclude_rules

Optional:

  • metadata_key (String) Metadata key the resource must carry.
  • metadata_value (String) Value of metadata_key; empty (or *) means any value.
  • name (String) Resource name, glob with * (e.g. sh.helm.release.v1.*).
  • resource_type (String) Resource type, exact match (e.g. ec2:instance).
  • tag_key (String) Tag the resource must carry.
  • tag_value (String) Value of tag_key; empty (or *) means any value.

Nested Schema for tracking_rules

Optional:

  • metadata_key (String) Metadata key the resource must carry.
  • metadata_value (String) Value of metadata_key; empty (or *) means any value.
  • name (String) Resource name, glob with * (e.g. sh.helm.release.v1.*).
  • resource_type (String) Resource type, exact match (e.g. ec2:instance).
  • tag_key (String) Tag the resource must carry.
  • tag_value (String) Value of tag_key; empty (or *) means any value.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The account id.
terraform import pruneops_cloud_account_resource_policy.aws_prod 6ae73542f34b47ceab99e2830a0244c8