Manage PruneOps with Terraform

The PruneOps Terraform provider configures your organization from code: connect accounts and clusters, set what is inventoried and tracked, and keep budgets and alerts reviewed like the rest of your infrastructure.

2 min read

What you can manage

The full reference, with every attribute and example, is at registry.pruneops.run.

Cloud accounts: Connect AWS, OVH, Hetzner, DigitalOcean, Cloudflare and the rest of the providers. Credentials are write-only: they never reach the Terraform state.
Kubernetes clusters: Register a cluster and get its agent token, ready to pass to the agent's Helm release.
Resource policies: What the organization, or one account, inventories and tracks.
Terraform states: Where PruneOps reads your state files to detect drift.
Cost settings: Allocation groups, budgets and the anomaly alert settings.
Findings: Which findings the analysis emits for your organization.

Setup

Create an API token under Organization → Integrations → API Tokens, ticking Write for what Terraform will manage. It is shown only once: keep it in your secret store.
Declare the provider. Its token comes from the PRUNEOPS_API_TOKEN environment variable, or from api_token in the provider block:

terraform {
  required_providers {
    pruneops = {
      source = "registry.pruneops.run/pruneops/pruneops"
    }
  }
}

provider "pruneops" {}

Run terraform init: Terraform downloads the provider from registry.pruneops.run and checks its signature. You need Terraform 1.11 or later.

Accounts, clusters and settings created in the app can be brought under Terraform with terraform import: see the provider's import guide.

API tokens

A token belongs to one organization and carries one permission per resource.

Read: Lists and reads: enough for terraform plan and data sources.
Write: Creates, changes and deletes. Includes read.
Revoking: A revoked token stops working within a few minutes. Revoke tokens nobody uses any more.

The same tokens authenticate the JSON API the provider is built on (/api/v1), for your own scripts: send them as Authorization: Bearer <token>.