Skip to content

admin_command_policy.md

Latest commit

 

History

History
78 lines (60 loc) · 3.36 KB

admin_command_policy.md

File metadata and controls

78 lines (60 loc) · 3.36 KB
Raw
page_title duploai_admin_command_policy Resource - duploai
subcategory
description Manages a DuploCloud AI Helpdesk command policy — reusable allow/block regular-expression lists that govern which agent-proposed commands are auto-approved or denied (deny-wins). A policy has no effect on its own; it takes effect once bound to a scope (System, Workspace, or Project) by a command policy mapping.

duploai_admin_command_policy (Resource)

Manages a DuploCloud AI Helpdesk command policy — reusable allow/block regular-expression lists that govern which agent-proposed commands are auto-approved or denied (deny-wins). A policy has no effect on its own; it takes effect once bound to a scope (System, Workspace, or Project) by a command policy mapping.

Example Usage

# Command policy: auto-approve safe read-only commands, always deny destructive ones.
# The policy has no effect until a command policy mapping binds it to a scope
# (System, Workspace, or Project).
resource "duploai_admin_command_policy" "read_only" {
  name        = "read-only-safe"
  description = "Auto-approve read-only inspection commands; deny anything destructive"

  allow_list = [
    "^kubectl (get|describe) .*",
    "^aws .* (describe|list|get)-.*",
  ]

  block_list = [
    "delete",
    "rm -rf",
    "drop database",
    "terraform destroy",
  ]
}

# Minimal policy — name only (empty allow/block lists; nothing auto-decided yet).
resource "duploai_admin_command_policy" "empty" {
  name = "baseline"
}

Schema

Required

  • name (String) Name of the command policy.

Optional

  • allow_list (List of String) Regular-expression patterns for commands that are auto-approved. A command matching any pattern here (and not matching the block list) is approved without human intervention. Each entry must be a valid regular expression; invalid patterns are rejected by the server.
  • block_list (List of String) Regular-expression patterns for commands that are always denied. Block takes precedence over allow (deny-wins). Each entry must be a valid regular expression; invalid patterns are rejected by the server.
  • description (String) Human-readable description of the policy.
  • is_active (Boolean) Whether the policy is active. Defaults to true.
  • metadata (Map of String) Arbitrary key/value metadata attached to the policy.

Read-Only

  • created_at (String) Timestamp when the policy was created (RFC 3339).
  • created_by (String) Identifier of the user who created the policy.
  • id (String) Composite resource identifier (workspace_id/id).
  • updated_at (String) Timestamp when the policy was last updated (RFC 3339).
  • updated_by (String) Identifier of the user who last updated the policy.
  • version (Number) Server-incremented version of the policy.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import an existing command policy by its ID.
#  - COMMAND_POLICY_ID is the unique identifier of the policy (e.g. 6a25105705686d697e0da225)
terraform import duploai_admin_command_policy.mypolicy COMMAND_POLICY_ID
# Example:
# terraform import duploai_admin_command_policy.mypolicy 6a25105705686d697e0da225