intutic_wasm_rule Biz Org+

A custom filter (/api/v1/wasm-rules): a native WebAssembly rule built with the Rules SDK, or a Rego policy built with intutic rules build --rego, uploaded to the workspace and run by its proxies. Custom filters need the Biz Org, Enterprise or Self-host plan (or a trial). The plan reads source and computes its SHA-256 as bundle_sha256; a different file, or a rule whose bytes on the server no longer match, replaces the rule, since the API cannot change an uploaded rule's bytes. After the upload the provider checks the API stored the same SHA-256 the proxies verify, and fails otherwise. Needs an OWNER or ADMIN key.

Example Usage

# A Rego policy compiled with `intutic rules build --rego`, pinned to the
# reviewed build.
resource "intutic_wasm_rule" "no_prod_deploys" {
  name        = "Hold production deploys"
  description = "Holds kubectl and helm against the production context for review."
  source      = "${path.module}/rules/hold_prod_deploys.wasm"
  sha256      = "3f5a0c9e7b1d24e8a6c0f9b2d47e15a83c6b9d0e2f714a58c3e6b1d9a07f42c1"
}

# A native rule built from the Rules SDK, uploaded switched off.
resource "intutic_wasm_rule" "deep_graphs" {
  name    = "Re-ask deep agent graphs"
  source  = "${path.module}/rules/deep_graphs.wasm"
  enabled = false
}

Schema

Required

• name (String)
• source (String) Path to the compiled .wasm file, at most 1 MB. It is read at plan time. Moving the file without changing it changes nothing in the workspace.

Optional

• description (String)
• enabled (Boolean) Whether the proxies run the rule. Defaults to true. The API enables a rule as it is uploaded, so with false it runs until the provider switches it off straight after.
• sha256 (String) The SHA-256 the file must have, as 64 hex characters: a pin, so the plan fails if source is not the build you reviewed.

Read-Only

• bundle_sha256 (String) The lowercase hex SHA-256 of the uploaded bytes, the value the proxies check the rule against. Computed from source at plan time; a change replaces the rule.
• id (String) The rule id (wasm_…).

Import

# Import by rule id. bundle_sha256 comes from the API; the next plan replaces
# the rule if the file in source has different bytes.
terraform import intutic_wasm_rule.no_prod_deploys wasm_0123456789abcdef