Tencent Cloud audit-ready Terraform Design and implementation

Audit tracks per service

What this code does: Defines audit tracks as a list, and each entry sets the target service (resource_type), the event names to record, and where to store them. The CAM track records permission events such as adding or deleting users, creating or deleting API keys, and attaching or detaching policies; the CVM track records servers being created, terminated, stopped, started, resized, and disks being attached or detached. Both store to COS but under separate cam and cvm prefixes, so each service’s log can be read and managed on its own.

  audit_tracks = [
    {
      name          = "iam_trackingset"
      resource_type = "CAM"
      event_names   = ["AddUser", "DeleteUser", "CreateApiKey", "DeleteApiKey", "AttachUserPolicy", "DetachUserPolicy"]
      action_type   = "*"
      storage = {
        storage_prefix = "cam"
        storage_type   = "cos"
      }
    },
    {
      name          = "vm_trackingset"
      resource_type = "CVM"
      event_names   = ["RunInstances", "TerminateInstances", "StopInstances", "StartInstances", "ResetInstancesType", "AttachDisks", "DetachDisks"]
      action_type   = "*"
      storage = {
        storage_prefix = "cvm"
        storage_type   = "cos"
      }
    },

Pinning the provider version

What this code does: Allows Terraform itself from 1.9 up to but not including 2.0, and pins the tencentcloud provider to exactly = 1.81.163. Because it is an exact version rather than a range, a new provider release is never picked up automatically, and the same code keeps producing the same plan.

terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    tencentcloud = {
      source  = "tencentcloudstack/tencentcloud"
      version = "= 1.81.163"
    }
  }
}