Resource identity overrides

GantryCD matches AWS resources by resource type, realm, and resource ID. It normally gets the ID from the resource ARN. Use these controls when that identity needs to change.

Override the resource ID

Set gantrycd:resource-identity-id in the resource’s own tags:

resource "aws_s3_bucket" "logs" {
  bucket = "shared-logs"

  tags = {
    "gantrycd:resource-identity-id" = "shared-logs"
  }
}

This value replaces the ID found by GantryCD. Set it on the resource, not in the AWS provider’s default_tags.

Set the realm

A realm separates resources with the same ID in different AWS-compatible endpoints. For example, give every taggable resource managed through this OpenStack S3 endpoint the same realm:

provider "aws" {
  endpoints {
    s3 = "https://s3.openstack.example.com"
  }

  default_tags {
    tags = {
      "gantrycd:resource-identity-realm" = "openstack-eu-1"
    }
  }
}

You can also set gantrycd:resource-identity-realm in one resource’s tags. Resources match only when their realms match.

Ignore tagged resources

Use the value "null" to remove the identity from a taggable resource:

tags = {
  "gantrycd:resource-identity-id" = "null"
}

Put this tag in default_tags to ignore all taggable resources for that AWS provider.

Ignore Terraform addresses

Comments also work for data sources and AWS resources without tags:

# gantrycd:resource-identity: ignore=true
data "aws_s3_bucket" "logs" {
  bucket = "external-logs"
}

Set resource=<address> to target another address. Use its full address from the stack root when it is inside a module:

# gantrycd:resource-identity: resource=module.legacy.aws_s3_bucket.logs ignore=true

GantryCD only reads comments in the root module. It does not resolve comments or relative addresses from inside child modules.

Use ignore=false on a more specific address to include it again:

# gantrycd:resource-identity: resource=module.legacy ignore=true
# gantrycd:resource-identity: resource=module.legacy.aws_sqs_queue.keep ignore=false