datadog.ActionExecutionPolicy

import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
// matching either target tag set below.
const kubernetesProdRead = new datadog.ActionExecutionPolicy("kubernetes_prod_read", {
    name: "allow-kubernetes-prod-read",
    effect: "allow",
    actionPattern: [{
        integration: "INTEGRATION_KUBERNETES",
        actionFqns: [
            "com.datadoghq.kubernetes.core.getPod",
            "com.datadoghq.kubernetes.core.listPod",
        ],
    }],
    scope: [{
        kubernetes: [{
            rules: [{
                targetNamespaces: [
                    "prod",
                    "prod-system",
                ],
            }],
        }],
    }],
    targets: [
        {
            name: "prod-us",
            agentTags: [
                "env:prod",
                "region:us-east-1",
            ],
        },
        {
            name: "prod-eu",
            agentTags: [
                "env:prod",
                "region:eu-west-1",
            ],
        },
    ],
});
// Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
const rshellStagingReadonly = new datadog.ActionExecutionPolicy("rshell_staging_readonly", {
    name: "rshell-staging-readonly",
    effect: "allow",
    actionPattern: [{
        integration: "INTEGRATION_REMOTE_ACTION",
        actionFqns: ["com.datadoghq.remoteaction.rshell.runCommand"],
    }],
    scope: [{
        remoteActionRshell: [{
            rules: [{
                targetPaths: ["/etc/datadog-agent/"],
                access: "read_only",
            }],
        }],
    }],
    targets: [{
        name: "staging",
        agentTags: ["env:staging"],
    }],
});
// Scripts: deny a specific shell script action everywhere, regardless of agent tags
// (no `target` block means the policy applies fleet-wide).
const denyDangerousScript = new datadog.ActionExecutionPolicy("deny_dangerous_script", {
    name: "deny-dangerous-cleanup-script",
    effect: "deny",
    actionPattern: [{
        integration: "INTEGRATION_SCRIPT",
        actionFqns: ["com.datadoghq.script.runShellScript"],
    }],
    scope: [{
        scripts: [{
            rules: [{
                targetScriptNames: ["dangerous-cleanup.sh"],
            }],
        }],
    }],
});
// Access to a policy is managed separately via datadog_restriction_policy,
// keyed by "execution-policy:<id>".
const kubernetesProdPerms = new datadog.RestrictionPolicy("kubernetes_prod_perms", {
    resourceId: pulumi.interpolate`execution-policy:${kubernetesProdRead.id}`,
    bindings: [{
        relation: "editor",
        principals: ["role:sre-oncall"],
    }],
});

import pulumi
import pulumi_datadog as datadog

# Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
# matching either target tag set below.
kubernetes_prod_read = datadog.ActionExecutionPolicy("kubernetes_prod_read",
    name="allow-kubernetes-prod-read",
    effect="allow",
    action_pattern=[{
        "integration": "INTEGRATION_KUBERNETES",
        "actionFqns": [
            "com.datadoghq.kubernetes.core.getPod",
            "com.datadoghq.kubernetes.core.listPod",
        ],
    }],
    scope=[{
        "kubernetes": [{
            "rules": [{
                "targetNamespaces": [
                    "prod",
                    "prod-system",
                ],
            }],
        }],
    }],
    targets=[
        {
            "name": "prod-us",
            "agent_tags": [
                "env:prod",
                "region:us-east-1",
            ],
        },
        {
            "name": "prod-eu",
            "agent_tags": [
                "env:prod",
                "region:eu-west-1",
            ],
        },
    ])
# Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
rshell_staging_readonly = datadog.ActionExecutionPolicy("rshell_staging_readonly",
    name="rshell-staging-readonly",
    effect="allow",
    action_pattern=[{
        "integration": "INTEGRATION_REMOTE_ACTION",
        "actionFqns": ["com.datadoghq.remoteaction.rshell.runCommand"],
    }],
    scope=[{
        "remoteActionRshell": [{
            "rules": [{
                "targetPaths": ["/etc/datadog-agent/"],
                "access": "read_only",
            }],
        }],
    }],
    targets=[{
        "name": "staging",
        "agent_tags": ["env:staging"],
    }])
# Scripts: deny a specific shell script action everywhere, regardless of agent tags
# (no `target` block means the policy applies fleet-wide).
deny_dangerous_script = datadog.ActionExecutionPolicy("deny_dangerous_script",
    name="deny-dangerous-cleanup-script",
    effect="deny",
    action_pattern=[{
        "integration": "INTEGRATION_SCRIPT",
        "actionFqns": ["com.datadoghq.script.runShellScript"],
    }],
    scope=[{
        "scripts": [{
            "rules": [{
                "targetScriptNames": ["dangerous-cleanup.sh"],
            }],
        }],
    }])
# Access to a policy is managed separately via datadog_restriction_policy,
# keyed by "execution-policy:<id>".
kubernetes_prod_perms = datadog.RestrictionPolicy("kubernetes_prod_perms",
    resource_id=kubernetes_prod_read.id.apply(lambda id: f"execution-policy:{id}"),
    bindings=[{
        "relation": "editor",
        "principals": ["role:sre-oncall"],
    }])

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
		// matching either target tag set below.
		kubernetesProdRead, err := datadog.NewActionExecutionPolicy(ctx, "kubernetes_prod_read", &datadog.ActionExecutionPolicyArgs{
			Name:   pulumi.String("allow-kubernetes-prod-read"),
			Effect: pulumi.String("allow"),
			ActionPattern: datadog.ActionExecutionPolicyActionPatternArgs{
				map[string]interface{}{
					"integration": "INTEGRATION_KUBERNETES",
					"actionFqns": []string{
						"com.datadoghq.kubernetes.core.getPod",
						"com.datadoghq.kubernetes.core.listPod",
					},
				},
			},
			Scope: datadog.ActionExecutionPolicyScopeArgs{
				map[string][]map[string][]map[string][]string{
					"kubernetes": []map[string][]map[string][]string{
						{
							"rules": []map[string][]string{
								{
									"targetNamespaces": []string{
										"prod",
										"prod-system",
									},
								},
							},
						},
					},
				},
			},
			Targets: datadog.ActionExecutionPolicyTargetArray{
				&datadog.ActionExecutionPolicyTargetArgs{
					Name: pulumi.String("prod-us"),
					AgentTags: pulumi.StringArray{
						pulumi.String("env:prod"),
						pulumi.String("region:us-east-1"),
					},
				},
				&datadog.ActionExecutionPolicyTargetArgs{
					Name: pulumi.String("prod-eu"),
					AgentTags: pulumi.StringArray{
						pulumi.String("env:prod"),
						pulumi.String("region:eu-west-1"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		// Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
		_, err = datadog.NewActionExecutionPolicy(ctx, "rshell_staging_readonly", &datadog.ActionExecutionPolicyArgs{
			Name:   pulumi.String("rshell-staging-readonly"),
			Effect: pulumi.String("allow"),
			ActionPattern: datadog.ActionExecutionPolicyActionPatternArgs{
				map[string]interface{}{
					"integration": "INTEGRATION_REMOTE_ACTION",
					"actionFqns": []string{
						"com.datadoghq.remoteaction.rshell.runCommand",
					},
				},
			},
			Scope: datadog.ActionExecutionPolicyScopeArgs{
				map[string][]map[string][]map[string]interface{}{
					"remoteActionRshell": []map[string][]map[string]interface{}{
						map[string][]map[string]interface{}{
							"rules": []map[string]interface{}{
								map[string]interface{}{
									"targetPaths": []string{
										"/etc/datadog-agent/",
									},
									"access": "read_only",
								},
							},
						},
					},
				},
			},
			Targets: datadog.ActionExecutionPolicyTargetArray{
				&datadog.ActionExecutionPolicyTargetArgs{
					Name: pulumi.String("staging"),
					AgentTags: pulumi.StringArray{
						pulumi.String("env:staging"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		// Scripts: deny a specific shell script action everywhere, regardless of agent tags
		// (no `target` block means the policy applies fleet-wide).
		_, err = datadog.NewActionExecutionPolicy(ctx, "deny_dangerous_script", &datadog.ActionExecutionPolicyArgs{
			Name:   pulumi.String("deny-dangerous-cleanup-script"),
			Effect: pulumi.String("deny"),
			ActionPattern: datadog.ActionExecutionPolicyActionPatternArgs{
				map[string]interface{}{
					"integration": "INTEGRATION_SCRIPT",
					"actionFqns": []string{
						"com.datadoghq.script.runShellScript",
					},
				},
			},
			Scope: datadog.ActionExecutionPolicyScopeArgs{
				map[string][]map[string][]map[string][]string{
					"scripts": []map[string][]map[string][]string{
						{
							"rules": []map[string][]string{
								{
									"targetScriptNames": []string{
										"dangerous-cleanup.sh",
									},
								},
							},
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		// Access to a policy is managed separately via datadog_restriction_policy,
		// keyed by "execution-policy:<id>".
		_, err = datadog.NewRestrictionPolicy(ctx, "kubernetes_prod_perms", &datadog.RestrictionPolicyArgs{
			ResourceId: kubernetesProdRead.ID().ApplyT(func(id pulumi.ID) (string, error) {
				return fmt.Sprintf("execution-policy:%v", id), nil
			}).(pulumi.StringOutput),
			Bindings: datadog.RestrictionPolicyBindingArray{
				&datadog.RestrictionPolicyBindingArgs{
					Relation: pulumi.String("editor"),
					Principals: pulumi.StringArray{
						pulumi.String("role:sre-oncall"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    // Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
    // matching either target tag set below.
    var kubernetesProdRead = new Datadog.ActionExecutionPolicy("kubernetes_prod_read", new()
    {
        Name = "allow-kubernetes-prod-read",
        Effect = "allow",
        ActionPattern = new[]
        {
            
            {
                { "integration", "INTEGRATION_KUBERNETES" },
                { "actionFqns", new[]
                {
                    "com.datadoghq.kubernetes.core.getPod",
                    "com.datadoghq.kubernetes.core.listPod",
                } },
            },
        },
        Scope = new[]
        {
            
            {
                { "kubernetes", new[]
                {
                    
                    {
                        { "rules", new[]
                        {
                            
                            {
                                { "targetNamespaces", new[]
                                {
                                    "prod",
                                    "prod-system",
                                } },
                            },
                        } },
                    },
                } },
            },
        },
        Targets = new[]
        {
            new Datadog.Inputs.ActionExecutionPolicyTargetArgs
            {
                Name = "prod-us",
                AgentTags = new[]
                {
                    "env:prod",
                    "region:us-east-1",
                },
            },
            new Datadog.Inputs.ActionExecutionPolicyTargetArgs
            {
                Name = "prod-eu",
                AgentTags = new[]
                {
                    "env:prod",
                    "region:eu-west-1",
                },
            },
        },
    });

    // Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
    var rshellStagingReadonly = new Datadog.ActionExecutionPolicy("rshell_staging_readonly", new()
    {
        Name = "rshell-staging-readonly",
        Effect = "allow",
        ActionPattern = new[]
        {
            
            {
                { "integration", "INTEGRATION_REMOTE_ACTION" },
                { "actionFqns", new[]
                {
                    "com.datadoghq.remoteaction.rshell.runCommand",
                } },
            },
        },
        Scope = new[]
        {
            
            {
                { "remoteActionRshell", new[]
                {
                    
                    {
                        { "rules", new[]
                        {
                            
                            {
                                { "targetPaths", new[]
                                {
                                    "/etc/datadog-agent/",
                                } },
                                { "access", "read_only" },
                            },
                        } },
                    },
                } },
            },
        },
        Targets = new[]
        {
            new Datadog.Inputs.ActionExecutionPolicyTargetArgs
            {
                Name = "staging",
                AgentTags = new[]
                {
                    "env:staging",
                },
            },
        },
    });

    // Scripts: deny a specific shell script action everywhere, regardless of agent tags
    // (no `target` block means the policy applies fleet-wide).
    var denyDangerousScript = new Datadog.ActionExecutionPolicy("deny_dangerous_script", new()
    {
        Name = "deny-dangerous-cleanup-script",
        Effect = "deny",
        ActionPattern = new[]
        {
            
            {
                { "integration", "INTEGRATION_SCRIPT" },
                { "actionFqns", new[]
                {
                    "com.datadoghq.script.runShellScript",
                } },
            },
        },
        Scope = new[]
        {
            
            {
                { "scripts", new[]
                {
                    
                    {
                        { "rules", new[]
                        {
                            
                            {
                                { "targetScriptNames", new[]
                                {
                                    "dangerous-cleanup.sh",
                                } },
                            },
                        } },
                    },
                } },
            },
        },
    });

    // Access to a policy is managed separately via datadog_restriction_policy,
    // keyed by "execution-policy:<id>".
    var kubernetesProdPerms = new Datadog.RestrictionPolicy("kubernetes_prod_perms", new()
    {
        ResourceId = kubernetesProdRead.Id.Apply(id => $"execution-policy:{id}"),
        Bindings = new[]
        {
            new Datadog.Inputs.RestrictionPolicyBindingArgs
            {
                Relation = "editor",
                Principals = new[]
                {
                    "role:sre-oncall",
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.ActionExecutionPolicy;
import com.pulumi.datadog.ActionExecutionPolicyArgs;
import com.pulumi.datadog.inputs.ActionExecutionPolicyTargetArgs;
import com.pulumi.datadog.RestrictionPolicy;
import com.pulumi.datadog.RestrictionPolicyArgs;
import com.pulumi.datadog.inputs.RestrictionPolicyBindingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
        // matching either target tag set below.
        var kubernetesProdRead = new ActionExecutionPolicy("kubernetesProdRead", ActionExecutionPolicyArgs.builder()
            .name("allow-kubernetes-prod-read")
            .effect("allow")
            .actionPattern(com.pulumi.datadog.inputs.ActionExecutionPolicyActionPatternArgs.builder()
                .integration("INTEGRATION_KUBERNETES")
                .actionFqns(                
                    "com.datadoghq.kubernetes.core.getPod",
                    "com.datadoghq.kubernetes.core.listPod")
                .build())
            .scope(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeArgs.builder()
                .kubernetes(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeKubernetesArgs.builder()
                    .rules(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeKubernetesRuleArgs.builder()
                        .targetNamespaces(                        
                            "prod",
                            "prod-system")
                        .build())
                    .build())
                .build())
            .targets(            
                ActionExecutionPolicyTargetArgs.builder()
                    .name("prod-us")
                    .agentTags(                    
                        "env:prod",
                        "region:us-east-1")
                    .build(),
                ActionExecutionPolicyTargetArgs.builder()
                    .name("prod-eu")
                    .agentTags(                    
                        "env:prod",
                        "region:eu-west-1")
                    .build())
            .build());

        // Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
        var rshellStagingReadonly = new ActionExecutionPolicy("rshellStagingReadonly", ActionExecutionPolicyArgs.builder()
            .name("rshell-staging-readonly")
            .effect("allow")
            .actionPattern(com.pulumi.datadog.inputs.ActionExecutionPolicyActionPatternArgs.builder()
                .integration("INTEGRATION_REMOTE_ACTION")
                .actionFqns("com.datadoghq.remoteaction.rshell.runCommand")
                .build())
            .scope(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeArgs.builder()
                .remoteActionRshell(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeRemoteActionRshellArgs.builder()
                    .rules(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeRemoteActionRshellRuleArgs.builder()
                        .targetPaths("/etc/datadog-agent/")
                        .access("read_only")
                        .build())
                    .build())
                .build())
            .targets(ActionExecutionPolicyTargetArgs.builder()
                .name("staging")
                .agentTags("env:staging")
                .build())
            .build());

        // Scripts: deny a specific shell script action everywhere, regardless of agent tags
        // (no `target` block means the policy applies fleet-wide).
        var denyDangerousScript = new ActionExecutionPolicy("denyDangerousScript", ActionExecutionPolicyArgs.builder()
            .name("deny-dangerous-cleanup-script")
            .effect("deny")
            .actionPattern(com.pulumi.datadog.inputs.ActionExecutionPolicyActionPatternArgs.builder()
                .integration("INTEGRATION_SCRIPT")
                .actionFqns("com.datadoghq.script.runShellScript")
                .build())
            .scope(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeArgs.builder()
                .scripts(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeScriptsArgs.builder()
                    .rules(com.pulumi.datadog.inputs.ActionExecutionPolicyScopeScriptsRuleArgs.builder()
                        .targetScriptNames("dangerous-cleanup.sh")
                        .build())
                    .build())
                .build())
            .build());

        // Access to a policy is managed separately via datadog_restriction_policy,
        // keyed by "execution-policy:<id>".
        var kubernetesProdPerms = new RestrictionPolicy("kubernetesProdPerms", RestrictionPolicyArgs.builder()
            .resourceId(kubernetesProdRead.id().applyValue(_id -> String.format("execution-policy:%s", _id)))
            .bindings(RestrictionPolicyBindingArgs.builder()
                .relation("editor")
                .principals("role:sre-oncall")
                .build())
            .build());

    }
}

resources:
  # Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
  # matching either target tag set below.
  kubernetesProdRead:
    type: datadog:ActionExecutionPolicy
    name: kubernetes_prod_read
    properties:
      name: allow-kubernetes-prod-read
      effect: allow
      actionPattern:
        - integration: INTEGRATION_KUBERNETES
          actionFqns:
            - com.datadoghq.kubernetes.core.getPod
            - com.datadoghq.kubernetes.core.listPod
      scope:
        - kubernetes:
            - rules:
                - targetNamespaces:
                    - prod
                    - prod-system
      targets:
        - name: prod-us
          agentTags:
            - env:prod
            - region:us-east-1
        - name: prod-eu
          agentTags:
            - env:prod
            - region:eu-west-1
  # Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
  rshellStagingReadonly:
    type: datadog:ActionExecutionPolicy
    name: rshell_staging_readonly
    properties:
      name: rshell-staging-readonly
      effect: allow
      actionPattern:
        - integration: INTEGRATION_REMOTE_ACTION
          actionFqns:
            - com.datadoghq.remoteaction.rshell.runCommand
      scope:
        - remoteActionRshell:
            - rules:
                - targetPaths:
                    - /etc/datadog-agent/
                  access: read_only
      targets:
        - name: staging
          agentTags:
            - env:staging
  # Scripts: deny a specific shell script action everywhere, regardless of agent tags
  # (no `target` block means the policy applies fleet-wide).
  denyDangerousScript:
    type: datadog:ActionExecutionPolicy
    name: deny_dangerous_script
    properties:
      name: deny-dangerous-cleanup-script
      effect: deny
      actionPattern:
        - integration: INTEGRATION_SCRIPT
          actionFqns:
            - com.datadoghq.script.runShellScript
      scope:
        - scripts:
            - rules:
                - targetScriptNames:
                    - dangerous-cleanup.sh
  # Access to a policy is managed separately via datadog_restriction_policy,
  # keyed by "execution-policy:<id>".
  kubernetesProdPerms:
    type: datadog:RestrictionPolicy
    name: kubernetes_prod_perms
    properties:
      resourceId: execution-policy:${kubernetesProdRead.id}
      bindings:
        - relation: editor
          principals:
            - role:sre-oncall

pulumi {
  required_providers {
    datadog = {
      source = "pulumi/datadog"
    }
  }
}

# Kubernetes: allow read-only actions against prod namespaces, on agents/PARs
# matching either target tag set below.
resource "datadog_actionexecutionpolicy" "kubernetes_prod_read" {
  name   = "allow-kubernetes-prod-read"
  effect = "allow"
  action_pattern = [{
    "integration" = "INTEGRATION_KUBERNETES"
    "actionFqns"  = ["com.datadoghq.kubernetes.core.getPod", "com.datadoghq.kubernetes.core.listPod"]
  }]
  scope = [{
    "kubernetes" = [{
      "rules" = [{
        "targetNamespaces" = ["prod", "prod-system"]
      }]
    }]
  }]
  targets {
    name       = "prod-us"
    agent_tags = ["env:prod", "region:us-east-1"]
  }
  targets {
    name       = "prod-eu"
    agent_tags = ["env:prod", "region:eu-west-1"]
  }
}
# Remote action (rshell): allow command execution restricted to a read-only path on staging agents.
resource "datadog_actionexecutionpolicy" "rshell_staging_readonly" {
  name   = "rshell-staging-readonly"
  effect = "allow"
  action_pattern = [{
    "integration" = "INTEGRATION_REMOTE_ACTION"
    "actionFqns"  = ["com.datadoghq.remoteaction.rshell.runCommand"]
  }]
  scope = [{
    "remoteActionRshell" = [{
      "rules" = [{
        "targetPaths" = ["/etc/datadog-agent/"]
        "access"      = "read_only"
      }]
    }]
  }]
  targets {
    name       = "staging"
    agent_tags = ["env:staging"]
  }
}
# Scripts: deny a specific shell script action everywhere, regardless of agent tags
# (no `target` block means the policy applies fleet-wide).
resource "datadog_actionexecutionpolicy" "deny_dangerous_script" {
  name   = "deny-dangerous-cleanup-script"
  effect = "deny"
  action_pattern = [{
    "integration" = "INTEGRATION_SCRIPT"
    "actionFqns"  = ["com.datadoghq.script.runShellScript"]
  }]
  scope = [{
    "scripts" = [{
      "rules" = [{
        "targetScriptNames" = ["dangerous-cleanup.sh"]
      }]
    }]
  }]
}
# Access to a policy is managed separately via datadog_restriction_policy,
# keyed by "execution-policy:<id>".
resource "datadog_restrictionpolicy" "kubernetes_prod_perms" {
  resource_id ="execution-policy:${datadog_actionexecutionpolicy.kubernetes_prod_read.id}"
  bindings {
    relation   = "editor"
    principals = ["role:sre-oncall"]
  }
}

var actionExecutionPolicyResource = new Datadog.ActionExecutionPolicy("actionExecutionPolicyResource", new()
{
    Effect = "string",
    Name = "string",
    ActionPattern = new Datadog.Inputs.ActionExecutionPolicyActionPatternArgs
    {
        ActionFqns = new[]
        {
            "string",
        },
        Integration = "string",
    },
    Scope = new Datadog.Inputs.ActionExecutionPolicyScopeArgs
    {
        Kubernetes = new Datadog.Inputs.ActionExecutionPolicyScopeKubernetesArgs
        {
            Rules = new[]
            {
                new Datadog.Inputs.ActionExecutionPolicyScopeKubernetesRuleArgs
                {
                    TargetNamespaces = new[]
                    {
                        "string",
                    },
                },
            },
        },
        RemoteActionRshell = new Datadog.Inputs.ActionExecutionPolicyScopeRemoteActionRshellArgs
        {
            Rules = new[]
            {
                new Datadog.Inputs.ActionExecutionPolicyScopeRemoteActionRshellRuleArgs
                {
                    Access = "string",
                    TargetPaths = new[]
                    {
                        "string",
                    },
                },
            },
        },
        Scripts = new Datadog.Inputs.ActionExecutionPolicyScopeScriptsArgs
        {
            Rules = new[]
            {
                new Datadog.Inputs.ActionExecutionPolicyScopeScriptsRuleArgs
                {
                    TargetScriptNames = new[]
                    {
                        "string",
                    },
                },
            },
        },
    },
    Targets = new[]
    {
        new Datadog.Inputs.ActionExecutionPolicyTargetArgs
        {
            AgentTags = new[]
            {
                "string",
            },
            Name = "string",
        },
    },
});

example, err := datadog.NewActionExecutionPolicy(ctx, "actionExecutionPolicyResource", &datadog.ActionExecutionPolicyArgs{
	Effect: pulumi.String("string"),
	Name:   pulumi.String("string"),
	ActionPattern: &datadog.ActionExecutionPolicyActionPatternArgs{
		ActionFqns: pulumi.StringArray{
			pulumi.String("string"),
		},
		Integration: pulumi.String("string"),
	},
	Scope: &datadog.ActionExecutionPolicyScopeArgs{
		Kubernetes: &datadog.ActionExecutionPolicyScopeKubernetesArgs{
			Rules: datadog.ActionExecutionPolicyScopeKubernetesRuleArray{
				&datadog.ActionExecutionPolicyScopeKubernetesRuleArgs{
					TargetNamespaces: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
		},
		RemoteActionRshell: &datadog.ActionExecutionPolicyScopeRemoteActionRshellArgs{
			Rules: datadog.ActionExecutionPolicyScopeRemoteActionRshellRuleArray{
				&datadog.ActionExecutionPolicyScopeRemoteActionRshellRuleArgs{
					Access: pulumi.String("string"),
					TargetPaths: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
		},
		Scripts: &datadog.ActionExecutionPolicyScopeScriptsArgs{
			Rules: datadog.ActionExecutionPolicyScopeScriptsRuleArray{
				&datadog.ActionExecutionPolicyScopeScriptsRuleArgs{
					TargetScriptNames: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
		},
	},
	Targets: datadog.ActionExecutionPolicyTargetArray{
		&datadog.ActionExecutionPolicyTargetArgs{
			AgentTags: pulumi.StringArray{
				pulumi.String("string"),
			},
			Name: pulumi.String("string"),
		},
	},
})

resource "datadog_action_execution_policy" "actionExecutionPolicyResource" {
  lifecycle {
    create_before_destroy = true
  }
  effect = "string"
  name   = "string"
  action_pattern = {
    action_fqns = ["string"]
    integration = "string"
  }
  scope = {
    kubernetes = {
      rules = [{
        target_namespaces = ["string"]
      }]
    }
    remote_action_rshell = {
      rules = [{
        access       = "string"
        target_paths = ["string"]
      }]
    }
    scripts = {
      rules = [{
        target_script_names = ["string"]
      }]
    }
  }
  targets {
    agent_tags = ["string"]
    name       = "string"
  }
}

var actionExecutionPolicyResource = new ActionExecutionPolicy("actionExecutionPolicyResource", ActionExecutionPolicyArgs.builder()
    .effect("string")
    .name("string")
    .actionPattern(ActionExecutionPolicyActionPatternArgs.builder()
        .actionFqns("string")
        .integration("string")
        .build())
    .scope(ActionExecutionPolicyScopeArgs.builder()
        .kubernetes(ActionExecutionPolicyScopeKubernetesArgs.builder()
            .rules(ActionExecutionPolicyScopeKubernetesRuleArgs.builder()
                .targetNamespaces("string")
                .build())
            .build())
        .remoteActionRshell(ActionExecutionPolicyScopeRemoteActionRshellArgs.builder()
            .rules(ActionExecutionPolicyScopeRemoteActionRshellRuleArgs.builder()
                .access("string")
                .targetPaths("string")
                .build())
            .build())
        .scripts(ActionExecutionPolicyScopeScriptsArgs.builder()
            .rules(ActionExecutionPolicyScopeScriptsRuleArgs.builder()
                .targetScriptNames("string")
                .build())
            .build())
        .build())
    .targets(ActionExecutionPolicyTargetArgs.builder()
        .agentTags("string")
        .name("string")
        .build())
    .build());

action_execution_policy_resource = datadog.ActionExecutionPolicy("actionExecutionPolicyResource",
    effect="string",
    name="string",
    action_pattern={
        "action_fqns": ["string"],
        "integration": "string",
    },
    scope={
        "kubernetes": {
            "rules": [{
                "target_namespaces": ["string"],
            }],
        },
        "remote_action_rshell": {
            "rules": [{
                "access": "string",
                "target_paths": ["string"],
            }],
        },
        "scripts": {
            "rules": [{
                "target_script_names": ["string"],
            }],
        },
    },
    targets=[{
        "agent_tags": ["string"],
        "name": "string",
    }])

const actionExecutionPolicyResource = new datadog.ActionExecutionPolicy("actionExecutionPolicyResource", {
    effect: "string",
    name: "string",
    actionPattern: {
        actionFqns: ["string"],
        integration: "string",
    },
    scope: {
        kubernetes: {
            rules: [{
                targetNamespaces: ["string"],
            }],
        },
        remoteActionRshell: {
            rules: [{
                access: "string",
                targetPaths: ["string"],
            }],
        },
        scripts: {
            rules: [{
                targetScriptNames: ["string"],
            }],
        },
    },
    targets: [{
        agentTags: ["string"],
        name: "string",
    }],
});

type: datadog:ActionExecutionPolicy
properties:
    actionPattern:
        actionFqns:
            - string
        integration: string
    effect: string
    name: string
    scope:
        kubernetes:
            rules:
                - targetNamespaces:
                    - string
        remoteActionRshell:
            rules:
                - access: string
                  targetPaths:
                    - string
        scripts:
            rules:
                - targetScriptNames:
                    - string
    targets:
        - agentTags:
            - string
          name: string