Terraform Provider for Last9

A Terraform provider for managing Last9 resources including alerts, log management rules, and notification channels.

Features

• Alerts: Configure alerting rules (metric-based with thresholds/expressions, or log-based with scheduled searches)
• Notification Channels: Manage alert destinations (Slack, PagerDuty, webhooks, email, etc.)
• Drop Rules: Filter and drop logs for cost optimization
• Forward Rules: Forward logs to external destinations

Installation

Using Terraform Registry (Recommended)

Add the provider to your Terraform configuration:

terraform {
  required_providers {
    last9 = {
      source  = "last9/last9"
      version = "~> 1.0"
    }
  }
}

Building from Source

git clone https://github.com/last9/terraform-provider-last9
cd terraform-provider-last9
go build -o terraform-provider-last9

Place the binary in your Terraform plugins directory:

• Linux/Mac: ~/.terraform.d/plugins/registry.terraform.io/last9/last9/1.0.0/linux_amd64/
• Windows: %APPDATA%\terraform.d\plugins\registry.terraform.io\last9\last9\1.0.0\windows_amd64\

Configuration

Configure the provider with your Last9 credentials. You can use either refresh tokens (recommended) or direct access tokens.

Using Refresh Tokens (Recommended)

provider "last9" {
  refresh_token = var.last9_refresh_token  # or use LAST9_REFRESH_TOKEN env var
  org           = var.last9_org            # or use LAST9_ORG env var
  api_base_url  = var.last9_api_base_url   # required - or use LAST9_API_BASE_URL env var
}

Using Direct Access Tokens (Legacy)

provider "last9" {
  api_token    = var.last9_api_token     # or use LAST9_API_TOKEN env var
  org          = var.last9_org           # or use LAST9_ORG env var
  api_base_url = var.last9_api_base_url  # required - or use LAST9_API_BASE_URL env var
}

Environment Variables

• LAST9_REFRESH_TOKEN - Your Last9 refresh token (recommended)
• LAST9_API_TOKEN - Your Last9 API access token (legacy)
• LAST9_ORG - Your Last9 organization slug
• LAST9_API_BASE_URL - API base URL (required)

Note: Either LAST9_REFRESH_TOKEN or LAST9_API_TOKEN must be provided. Refresh tokens are recommended as they automatically handle token refresh.

Usage Examples

See the examples directory for complete examples.

Alert

resource "last9_alert" "high_error_rate" {
  entity_id   = last9_entity.example.id
  name        = "High Error Rate"
  description = "Alert when error rate exceeds 100 req/min"
  indicator   = "error_rate"
  
  greater_than  = 100
  bad_minutes   = 5
  total_minutes = 10
  
  severity = "breach"
  
  properties {
    runbook_url = "https://wiki.example.com/runbooks/high-error-rate"
    annotations = {
      priority = "high"
      team     = "platform"
    }
  }
}

Drop Rule

resource "last9_drop_rule" "debug_logs" {
  region    = "us-west-2"
  name      = "drop-debug-logs"
  telemetry = "logs"

  filters {
    key         = "attributes[\"severity\"]"
    value       = "debug"
    operator    = "equals"
    conjunction = "and"
  }
}

Forward Rule

resource "last9_forward_rule" "external_logs" {
  region      = "us-west-2"
  name        = "forward-critical-logs"
  telemetry   = "logs"
  destination = "https://logs.external-system.com/webhook"

  filters {
    key         = "attributes[\"severity\"]"
    value       = "critical"
    operator    = "equals"
    conjunction = "and"
  }

  filters {
    key         = "attributes[\"service\"]"
    value       = "payment-service"
    operator    = "equals"
    conjunction = "and"
  }
}

Resources

• last9_entity - Create alert groups for organizing metric-based alerts
• last9_alert - Configure metric-based alert rules
• last9_drop_rule - Configure log drop rules for filtering
• last9_forward_rule - Set up log forwarding to external destinations
• last9_scheduled_search_alert - Create log-based scheduled search alerts
• last9_notification_channel - Manage alert notification destinations

Data Sources

• last9_entity - Query alert group information
• last9_notification_destination - Query notification destinations for alerts

Development

Prerequisites

• Go 1.21 or later
• Terraform 1.0 or later

Building

go build -o terraform-provider-last9

Testing

go test ./...

Running Acceptance Tests

TF_ACC=1 go test ./... -v

Contributing

Contributions are welcome! Please read our contributing guidelines first.

License

Mozilla Public License 2.0 - see LICENSE file for details

Support

For issues and questions:

• GitHub Issues: https://github.com/last9/terraform-provider-last9/issues
• Documentation: https://docs.last9.io