# Terraform Provider

> Manage Last9 resources as Infrastructure as Code using the official Terraform provider

Source: https://last9.io/docs/terraform-provider/

The [Last9 Terraform Provider](https://registry.terraform.io/providers/last9/last9) enables Infrastructure as Code (IaC) management of Last9 resources. You can version control, review, and automate the deployment of alerts, notification channels, and ingestion rules.

## Prerequisites

1. [Terraform](https://www.terraform.io/downloads) v1.0 or later installed
2. A Last9 account with access to the [API Access](https://app.last9.io/settings/api-access) page
3. API tokens generated from the API Access page (see [Getting Started with API](/docs/getting-started-with-api/))

## Installation

Add the provider to your Terraform configuration:

```hcl
terraform {
  required_providers {
    last9 = {
      source  = "last9/last9"
      version = "~> 0.4"
    }
  }
}
```

Run `terraform init` to download the provider.

## Configuration

Configure the provider with your Last9 credentials. You can use either refresh tokens (recommended) or direct access tokens.

### Using Refresh Tokens (Recommended)

Refresh tokens automatically handle token expiration and renewal:

```hcl
provider "last9" {
  refresh_token        = var.last9_refresh_token
  delete_refresh_token = var.last9_delete_refresh_token
  org                  = var.last9_org
  api_base_url         = "https://app.last9.io"
}
```

### Using Direct Access Tokens

For simpler setups where you manage token refresh manually:

```hcl
provider "last9" {
  api_token    = var.last9_api_token
  delete_token = var.last9_delete_token
  org          = var.last9_org
  api_base_url = "https://app.last9.io"
}
```

### Environment Variables

All provider arguments can be set via environment variables:

| Argument               | Environment Variable         | Description                             |
| ---------------------- | ---------------------------- | --------------------------------------- |
| `refresh_token`        | `LAST9_REFRESH_TOKEN`        | Refresh token for read/write operations |
| `delete_refresh_token` | `LAST9_DELETE_REFRESH_TOKEN` | Refresh token for delete operations     |
| `api_token`            | `LAST9_API_TOKEN`            | Direct access token                     |
| `delete_token`         | `LAST9_DELETE_TOKEN`         | Delete access token                     |
| `org`                  | `LAST9_ORG`                  | Organization slug                       |
| `api_base_url`         | `LAST9_API_BASE_URL`         | API base URL                            |

:::tip
Use refresh tokens in production. They automatically renew expired access tokens, eliminating manual token rotation.
:::

## Available Resources

| Resource                       | Description                                   |
| ------------------------------ | --------------------------------------------- |
| `last9_entity`                 | Alert groups that contain metric-based alerts |
| `last9_alert`                  | Threshold-based alerts on metrics             |
| `last9_scheduled_search_alert` | Log-based alerts using scheduled searches     |
| `last9_notification_channel`   | Notification destinations for alerts          |
| `last9_dashboard`              | Dashboards across metrics, logs, and traces   |
| `last9_drop_rule`              | Drop unwanted telemetry at ingestion layer    |
| `last9_forward_rule`           | Forward telemetry to external destinations    |
| `last9_remapping_rule`         | Extract and remap fields from logs and traces |

## Data Sources

| Data Source                      | Description                                           |
| -------------------------------- | ----------------------------------------------------- |
| `last9_entity`                   | Query existing alert group by ID or external_ref      |
| `last9_notification_destination` | Query existing notification destination by ID or name |

## Example Usage

Here's a basic example that creates a Slack notification channel and a drop rule for debug logs:

```hcl
# Notification channel
resource "last9_notification_channel" "slack" {
  name          = "platform-alerts"
  type          = "slack"
  destination   = "https://hooks.slack.com/services/xxx/yyy/zzz"
  send_resolved = true
}

# Drop debug logs to reduce costs
resource "last9_drop_rule" "debug_logs" {
  region    = "ap-south-1"
  name      = "drop-debug-logs"
  telemetry = "logs"

  filters {
    key      = "attributes[\"level\"]"
    value    = "debug"
    operator = "equals"
  }

  action {
    name = "drop-matching"
  }
}
```

For detailed schema documentation and more examples, see the [Terraform Registry documentation](https://registry.terraform.io/providers/last9/last9/latest/docs).

---

## Troubleshooting

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.