Skip to content

pruneops_resource_policy (Resource)

What PruneOps inventories and tracks. Without account_id, the organization's policy: the default for every account (destroying it leaves nothing excluded and nothing tracked). With account_id, that account's override, which replaces the organization's policy as a whole for the account (destroying it falls back to the organization's). Declare at most one per scope.

Example Usage

# The organization's policy: the default for every account.
resource "pruneops_resource_policy" "organization" {
  # Never inventory Helm release secrets.
  inventory_exclude_rules = [
    { resource_type = "k8s:secret", name = "sh.helm.release.v1.*" },
  ]

  # Track what is tagged with a team.
  tracking_rules = [
    { tag_key = "team" },
  ]
}

# An account's override: replaces the organization's policy as a whole for
# this account.
resource "pruneops_resource_policy" "aws_prod" {
  account_id = pruneops_cloud_account.aws_prod.id

  # Track everything except what is tagged env=dev.
  track_all = true
  tracking_exclude_rules = [
    { tag_key = "env", tag_value = "dev" },
  ]
}

Schema

Optional

  • account_id (String) A pruneops_cloud_account id to override its policy; leave it out for the organization's.
  • inventory_exclude_rules (Attributes List) Resources never inventoried (everything else is). Within a rule every set field must match (AND); any rule matching is enough (OR). A rule needs resource_type, name, tag_key or metadata_key. Values are case-insensitive and must be written lowercase. (see below for nested schema)
  • track_all (Boolean) Track every inventoried resource (tracking_exclude_rules still win).
  • tracking_exclude_rules (Attributes List) Resources never tracked, whatever track_all and tracking_rules say. Within a rule every set field must match (AND); any rule matching is enough (OR). A rule needs resource_type, name, tag_key or metadata_key. Values are case-insensitive and must be written lowercase. (see below for nested schema)
  • tracking_rules (Attributes List) Resources tracked (cost and usage). Within a rule every set field must match (AND); any rule matching is enough (OR). A rule needs resource_type, name, tag_key or metadata_key. Values are case-insensitive and must be written lowercase. (see below for nested schema)

Nested Schema for inventory_exclude_rules

Optional:

  • metadata_key (String) Metadata key the resource must carry.
  • metadata_value (String) Value of metadata_key; empty (or *) means any value.
  • name (String) Resource name, glob with * (e.g. sh.helm.release.v1.*).
  • resource_type (String) Resource type, exact match (e.g. ec2:instance).
  • tag_key (String) Tag the resource must carry.
  • tag_value (String) Value of tag_key; empty (or *) means any value.

Nested Schema for tracking_exclude_rules

Optional:

  • metadata_key (String) Metadata key the resource must carry.
  • metadata_value (String) Value of metadata_key; empty (or *) means any value.
  • name (String) Resource name, glob with * (e.g. sh.helm.release.v1.*).
  • resource_type (String) Resource type, exact match (e.g. ec2:instance).
  • tag_key (String) Tag the resource must carry.
  • tag_value (String) Value of tag_key; empty (or *) means any value.

Nested Schema for tracking_rules

Optional:

  • metadata_key (String) Metadata key the resource must carry.
  • metadata_value (String) Value of metadata_key; empty (or *) means any value.
  • name (String) Resource name, glob with * (e.g. sh.helm.release.v1.*).
  • resource_type (String) Resource type, exact match (e.g. ec2:instance).
  • tag_key (String) Tag the resource must carry.
  • tag_value (String) Value of tag_key; empty (or *) means any value.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The organization's policy:
terraform import pruneops_resource_policy.organization organization

# An account's override, by account id:
terraform import pruneops_resource_policy.aws_prod 6ae73542f34b47ceab99e2830a0244c8