Provides a Datadog SensitiveDataScannerRule resource. This can be used to create and manage Datadog sensitive_data_scanner_rule. Setting the create_before_destroy
lifecycle Meta-argument to true
is highly recommended if modifying the included_keyword_configuration
field to avoid unexpectedly disabling Sensitive Data Scanner groups.
# Create new sensitive_data_scanner_rule resource in a sensitive_data_scanner_group
resource "datadog_sensitive_data_scanner_group" "mygroup" {
name = "My new scanning group"
description = "A relevant description"
filter {
query = "service:my-service"
}
is_enabled = true
product_list = ["apm"]
}
resource "datadog_sensitive_data_scanner_rule" "myrule" {
lifecycle {
// Use this meta-argument to avoid disabling the group when modifying the
// `included_keyword_configuration` field
create_before_destroy = true
}
name = "My new rule"
description = "Another description"
group_id = datadog_sensitive_data_scanner_group.mygroup.id
excluded_namespaces = ["username"]
is_enabled = true
pattern = "myregex"
tags = ["sensitive_data:true"]
text_replacement {
number_of_chars = 0
replacement_string = ""
type = "hash"
}
included_keyword_configuration {
keywords = ["cc", "credit card"]
character_count = 30
}
}
data "datadog_sensitive_data_scanner_standard_pattern" "aws_sp" {
filter = "AWS Access Key ID Scanner"
}
resource "datadog_sensitive_data_scanner_rule" "mylibraryrule" {
name = "My library rule"
description = "A description"
group_id = datadog_sensitive_data_scanner_group.mygroup.id
// As standard_pattern_id is provided, the resource MUST NOT contain the "pattern" attribute
standard_pattern_id = data.datadog_sensitive_data_scanner_standard_pattern.aws_sp.id
excluded_namespaces = ["username"]
is_enabled = true
tags = ["sensitive_data:true"]
}
group_id
(String) Id of the scanning group the rule belongs to.description
(String) Description of the rule.excluded_namespaces
(List of String) Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array.included_keyword_configuration
(Block List, Max: 1) Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a defined proximity of the matching pattern. If any of the keywords are found within the proximity check then the match is kept. If none are found, the match is discarded. Setting the create_before_destroy
lifecycle Meta-argument to true
is highly recommended if modifying this field to avoid unexpectedly disabling Sensitive Data Scanner groups. (see below for nested schema)is_enabled
(Boolean) Whether or not the rule is enabled.name
(String) Name of the rule.namespaces
(List of String) Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned. If both are missing the whole event is scanned.pattern
(String) Not included if there is a relationship to a standard pattern.standard_pattern_id
(String) Id of the standard pattern the rule refers to. If provided, then pattern must not be provided.tags
(List of String) List of tags.text_replacement
(Block List, Max: 1) Object describing how the scanned event will be replaced. Defaults to type: none
(see below for nested schema)id
(String) The ID of this resource.included_keyword_configuration
Required:
character_count
(Number) Number of characters before the match to find a keyword validating the match. It must be between 1 and 50 (inclusive).keywords
(List of String) Keyword list that is checked during scanning in order to validate a match. The number of keywords in the list must be lower than or equal to 30.text_replacement
Required:
type
(String) Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacement_string means that one can chose a text to replace the data. partial_replacement_from_beginning allows a user to partially replace the data from the beginning, and partial_replacement_from_end on the other hand, allows to replace data from the end. Valid values are none
, hash
, replacement_string
, partial_replacement_from_beginning
, partial_replacement_from_end
.Optional:
number_of_chars
(Number) Required if type == 'partial_replacement_from_beginning' or 'partial_replacement_from_end'. It must be > 0.replacement_string
(String) Required if type == 'replacement_string'.Import is supported using the following syntax:
terraform import datadog_sensitive_data_scanner_rule.new_list ""