Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Datadog Provider
  4. API Docs
  5. GovernanceControl
Viewing docs for Datadog v5.11.0
published on Tuesday, Sep 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

datadog.GovernanceControl

datadog logo
Viewing docs for Datadog v5.11.0
published on Tuesday, Sep 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

    Provides a Datadog Governance Control resource. This can be used to configure built-in Governance Console controls, such as their detection, mitigation, and notification settings. Controls are built into Datadog: this resource configures an existing control rather than creating one, and removing it from Terraform only removes it from state.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Configure the built-in "Unused API Keys" governance control
const unusedApiKeys = new datadog.GovernanceControl("unused_api_keys", {
    detectionType: "unused_api_keys",
    detectionParameters: JSON.stringify({
        api_key_threshold: 30,
    }),
    notificationSettings: [{
        event_type: "new_detection",
        enabled: true,
        targets: [{
            type: "slack",
            handle: "#platform-governance",
        }],
    }],
});

    import pulumi
import json
import pulumi_datadog as datadog

# Configure the built-in "Unused API Keys" governance control
unused_api_keys = datadog.GovernanceControl("unused_api_keys",
    detection_type="unused_api_keys",
    detection_parameters=json.dumps({
        "api_key_threshold": 30,
    }),
    notification_settings=[{
        "event_type": "new_detection",
        "enabled": True,
        "targets": [{
            "type": "slack",
            "handle": "#platform-governance",
        }],
    }])

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]int{
			"api_key_threshold": 30,
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		// Configure the built-in "Unused API Keys" governance control
		_, err = datadog.NewGovernanceControl(ctx, "unused_api_keys", &datadog.GovernanceControlArgs{
			DetectionType:       pulumi.String("unused_api_keys"),
			DetectionParameters: pulumi.String(json0),
			NotificationSettings: datadog.GovernanceControlNotificationSettingArray{
				&datadog.GovernanceControlNotificationSettingArgs{
					Event_type: "new_detection",
					Enabled:    pulumi.Bool(true),
					Targets: datadog.GovernanceControlNotificationSettingTargetArray{
						&datadog.GovernanceControlNotificationSettingTargetArgs{
							Type:   pulumi.String("slack"),
							Handle: pulumi.String("#platform-governance"),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    // Configure the built-in "Unused API Keys" governance control
    var unusedApiKeys = new Datadog.GovernanceControl("unused_api_keys", new()
    {
        DetectionType = "unused_api_keys",
        DetectionParameters = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["api_key_threshold"] = 30,
        }),
        NotificationSettings = new[]
        {
            new Datadog.Inputs.GovernanceControlNotificationSettingArgs
            {
                Event_type = "new_detection",
                Enabled = true,
                Targets = new[]
                {
                    new Datadog.Inputs.GovernanceControlNotificationSettingTargetArgs
                    {
                        Type = "slack",
                        Handle = "#platform-governance",
                    },
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.GovernanceControl;
import com.pulumi.datadog.GovernanceControlArgs;
import com.pulumi.datadog.inputs.GovernanceControlNotificationSettingArgs;
import com.pulumi.datadog.inputs.GovernanceControlNotificationSettingTargetArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Configure the built-in "Unused API Keys" governance control
        var unusedApiKeys = new GovernanceControl("unusedApiKeys", GovernanceControlArgs.builder()
            .detectionType("unused_api_keys")
            .detectionParameters(serializeJson(
                jsonObject(
                    jsonProperty("api_key_threshold", 30)
                )))
            .notificationSettings(GovernanceControlNotificationSettingArgs.builder()
                .event_type("new_detection")
                .enabled(true)
                .targets(GovernanceControlNotificationSettingTargetArgs.builder()
                    .type("slack")
                    .handle("#platform-governance")
                    .build())
                .build())
            .build());

    }
}

    resources:
  # Configure the built-in "Unused API Keys" governance control
  unusedApiKeys:
    type: datadog:GovernanceControl
    name: unused_api_keys
    properties:
      detectionType: unused_api_keys
      detectionParameters:
        fn::toJSON:
          api_key_threshold: 30
      notificationSettings:
        - event_type: new_detection
          enabled: true
          targets:
            - type: slack
              handle: '#platform-governance'

    pulumi {
  required_providers {
    datadog = {
      source = "pulumi/datadog"
    }
  }
}

# Configure the built-in "Unused API Keys" governance control
resource "datadog_governancecontrol" "unused_api_keys" {
  detection_type = "unused_api_keys"
  detection_parameters = jsonencode({
    "api_key_threshold" = 30
  })
  notification_settings {
    event_type = "new_detection"
    enabled    = true
    targets {
      type   = "slack"
      handle = "#platform-governance"
    }
  }
}

    Create GovernanceControl Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GovernanceControl(name: string, args: GovernanceControlArgs, opts?: CustomResourceOptions);
    @overload
def GovernanceControl(resource_name: str,
                      args: GovernanceControlArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def GovernanceControl(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      detection_type: Optional[str] = None,
                      detection_parameters: Optional[str] = None,
                      mitigation_parameters: Optional[str] = None,
                      mitigation_type: Optional[str] = None,
                      notification_settings: Optional[Sequence[GovernanceControlNotificationSettingArgs]] = None)
    func NewGovernanceControl(ctx *Context, name string, args GovernanceControlArgs, opts ...ResourceOption) (*GovernanceControl, error)
    public GovernanceControl(string name, GovernanceControlArgs args, CustomResourceOptions? opts = null)
    public GovernanceControl(String name, GovernanceControlArgs args)
public GovernanceControl(String name, GovernanceControlArgs args, CustomResourceOptions options)

    type: datadog:GovernanceControl
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "datadog_governance_control" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GovernanceControlArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GovernanceControlArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GovernanceControlArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GovernanceControlArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GovernanceControlArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var governanceControlResource = new Datadog.GovernanceControl("governanceControlResource", new()
{
    DetectionType = "string",
    DetectionParameters = "string",
    MitigationParameters = "string",
    MitigationType = "string",
    NotificationSettings = new[]
    {
        new Datadog.Inputs.GovernanceControlNotificationSettingArgs
        {
            Enabled = false,
            EventType = "string",
            Targets = new[]
            {
                new Datadog.Inputs.GovernanceControlNotificationSettingTargetArgs
                {
                    Handle = "string",
                    Type = "string",
                },
            },
        },
    },
});

    example, err := datadog.NewGovernanceControl(ctx, "governanceControlResource", &datadog.GovernanceControlArgs{
	DetectionType:        pulumi.String("string"),
	DetectionParameters:  pulumi.String("string"),
	MitigationParameters: pulumi.String("string"),
	MitigationType:       pulumi.String("string"),
	NotificationSettings: datadog.GovernanceControlNotificationSettingArray{
		&datadog.GovernanceControlNotificationSettingArgs{
			Enabled:   pulumi.Bool(false),
			EventType: pulumi.String("string"),
			Targets: datadog.GovernanceControlNotificationSettingTargetArray{
				&datadog.GovernanceControlNotificationSettingTargetArgs{
					Handle: pulumi.String("string"),
					Type:   pulumi.String("string"),
				},
			},
		},
	},
})

    resource "datadog_governance_control" "governanceControlResource" {
  lifecycle {
    create_before_destroy = true
  }
  detection_type        = "string"
  detection_parameters  = "string"
  mitigation_parameters = "string"
  mitigation_type       = "string"
  notification_settings {
    enabled    = false
    event_type = "string"
    targets {
      handle = "string"
      type   = "string"
    }
  }
}

    var governanceControlResource = new GovernanceControl("governanceControlResource", GovernanceControlArgs.builder()
    .detectionType("string")
    .detectionParameters("string")
    .mitigationParameters("string")
    .mitigationType("string")
    .notificationSettings(GovernanceControlNotificationSettingArgs.builder()
        .enabled(false)
        .eventType("string")
        .targets(GovernanceControlNotificationSettingTargetArgs.builder()
            .handle("string")
            .type("string")
            .build())
        .build())
    .build());

    governance_control_resource = datadog.GovernanceControl("governanceControlResource",
    detection_type="string",
    detection_parameters="string",
    mitigation_parameters="string",
    mitigation_type="string",
    notification_settings=[{
        "enabled": False,
        "event_type": "string",
        "targets": [{
            "handle": "string",
            "type": "string",
        }],
    }])

    const governanceControlResource = new datadog.GovernanceControl("governanceControlResource", {
    detectionType: "string",
    detectionParameters: "string",
    mitigationParameters: "string",
    mitigationType: "string",
    notificationSettings: [{
        enabled: false,
        eventType: "string",
        targets: [{
            handle: "string",
            type: "string",
        }],
    }],
});

    type: datadog:GovernanceControl
properties:
    detectionParameters: string
    detectionType: string
    mitigationParameters: string
    mitigationType: string
    notificationSettings:
        - enabled: false
          eventType: string
          targets:
            - handle: string
              type: string

    GovernanceControl Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GovernanceControl resource accepts the following input properties:

    DetectionType string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    DetectionParameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    MitigationParameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    MitigationType string
    The mitigation type configured for the control. Empty when not configured.
    NotificationSettings List<GovernanceControlNotificationSetting>
    The notification settings for the control, one entry per event type.
    DetectionType string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    DetectionParameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    MitigationParameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    MitigationType string
    The mitigation type configured for the control. Empty when not configured.
    NotificationSettings []GovernanceControlNotificationSettingArgs
    The notification settings for the control, one entry per event type.
    detection_type string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    detection_parameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigation_parameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigation_type string
    The mitigation type configured for the control. Empty when not configured.
    notification_settings list(object)
    The notification settings for the control, one entry per event type.
    detectionType String
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    detectionParameters String
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationParameters String
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationType String
    The mitigation type configured for the control. Empty when not configured.
    notificationSettings List<GovernanceControlNotificationSetting>
    The notification settings for the control, one entry per event type.
    detectionType string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    detectionParameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationParameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationType string
    The mitigation type configured for the control. Empty when not configured.
    notificationSettings GovernanceControlNotificationSetting[]
    The notification settings for the control, one entry per event type.
    detection_type str
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    detection_parameters str
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigation_parameters str
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigation_type str
    The mitigation type configured for the control. Empty when not configured.
    notification_settings Sequence[GovernanceControlNotificationSettingArgs]
    The notification settings for the control, one entry per event type.
    detectionType String
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    detectionParameters String
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationParameters String
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationType String
    The mitigation type configured for the control. Empty when not configured.
    notificationSettings List<Property Map>
    The notification settings for the control, one entry per event type.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GovernanceControl resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Human-readable name of the control.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Human-readable name of the control.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    Human-readable name of the control.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Human-readable name of the control.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    Human-readable name of the control.
    id str
    The provider-assigned unique ID for this managed resource.
    name str
    Human-readable name of the control.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Human-readable name of the control.

    Look up Existing GovernanceControl Resource

    Get an existing GovernanceControl resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GovernanceControlState, opts?: CustomResourceOptions): GovernanceControl
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        detection_parameters: Optional[str] = None,
        detection_type: Optional[str] = None,
        mitigation_parameters: Optional[str] = None,
        mitigation_type: Optional[str] = None,
        name: Optional[str] = None,
        notification_settings: Optional[Sequence[GovernanceControlNotificationSettingArgs]] = None) -> GovernanceControl
    func GetGovernanceControl(ctx *Context, name string, id IDInput, state *GovernanceControlState, opts ...ResourceOption) (*GovernanceControl, error)
    public static GovernanceControl Get(string name, Input<string> id, GovernanceControlState? state, CustomResourceOptions? opts = null)
    public static GovernanceControl get(String name, Output<String> id, GovernanceControlState state, CustomResourceOptions options)
    resources:  _:    type: datadog:GovernanceControl    get:      id: ${id}
    import {
  to = datadog_governance_control.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DetectionParameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    DetectionType string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    MitigationParameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    MitigationType string
    The mitigation type configured for the control. Empty when not configured.
    Name string
    Human-readable name of the control.
    NotificationSettings List<GovernanceControlNotificationSetting>
    The notification settings for the control, one entry per event type.
    DetectionParameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    DetectionType string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    MitigationParameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    MitigationType string
    The mitigation type configured for the control. Empty when not configured.
    Name string
    Human-readable name of the control.
    NotificationSettings []GovernanceControlNotificationSettingArgs
    The notification settings for the control, one entry per event type.
    detection_parameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    detection_type string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    mitigation_parameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigation_type string
    The mitigation type configured for the control. Empty when not configured.
    name string
    Human-readable name of the control.
    notification_settings list(object)
    The notification settings for the control, one entry per event type.
    detectionParameters String
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    detectionType String
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    mitigationParameters String
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationType String
    The mitigation type configured for the control. Empty when not configured.
    name String
    Human-readable name of the control.
    notificationSettings List<GovernanceControlNotificationSetting>
    The notification settings for the control, one entry per event type.
    detectionParameters string
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    detectionType string
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    mitigationParameters string
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationType string
    The mitigation type configured for the control. Empty when not configured.
    name string
    Human-readable name of the control.
    notificationSettings GovernanceControlNotificationSetting[]
    The notification settings for the control, one entry per event type.
    detection_parameters str
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    detection_type str
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    mitigation_parameters str
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigation_type str
    The mitigation type configured for the control. Empty when not configured.
    name str
    Human-readable name of the control.
    notification_settings Sequence[GovernanceControlNotificationSettingArgs]
    The notification settings for the control, one entry per event type.
    detectionParameters String
    Detection parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    detectionType String
    The detection type that uniquely identifies the control, for example unusedApiKeys.
    mitigationParameters String
    Mitigation parameters for the control, as a JSON-encoded map of parameter names to their configured values.
    mitigationType String
    The mitigation type configured for the control. Empty when not configured.
    name String
    Human-readable name of the control.
    notificationSettings List<Property Map>
    The notification settings for the control, one entry per event type.

    Supporting Types

    GovernanceControlNotificationSetting, GovernanceControlNotificationSettingArgs

    Enabled bool
    Whether notifications are enabled for this event type.
    EventType string
    The event type the notification settings apply to, such as newDetection.
    Targets List<GovernanceControlNotificationSettingTarget>
    The destinations that receive notifications for this event type.
    Enabled bool
    Whether notifications are enabled for this event type.
    EventType string
    The event type the notification settings apply to, such as newDetection.
    Targets []GovernanceControlNotificationSettingTarget
    The destinations that receive notifications for this event type.
    enabled bool
    Whether notifications are enabled for this event type.
    event_type string
    The event type the notification settings apply to, such as newDetection.
    targets list(object)
    The destinations that receive notifications for this event type.
    enabled Boolean
    Whether notifications are enabled for this event type.
    eventType String
    The event type the notification settings apply to, such as newDetection.
    targets List<GovernanceControlNotificationSettingTarget>
    The destinations that receive notifications for this event type.
    enabled boolean
    Whether notifications are enabled for this event type.
    eventType string
    The event type the notification settings apply to, such as newDetection.
    targets GovernanceControlNotificationSettingTarget[]
    The destinations that receive notifications for this event type.
    enabled bool
    Whether notifications are enabled for this event type.
    event_type str
    The event type the notification settings apply to, such as newDetection.
    targets Sequence[GovernanceControlNotificationSettingTarget]
    The destinations that receive notifications for this event type.
    enabled Boolean
    Whether notifications are enabled for this event type.
    eventType String
    The event type the notification settings apply to, such as newDetection.
    targets List<Property Map>
    The destinations that receive notifications for this event type.

    GovernanceControlNotificationSettingTarget, GovernanceControlNotificationSettingTargetArgs

    Handle string
    The handle of the notification target.
    Type string
    The type of notification target: email, slack, atMention, or case.
    Handle string
    The handle of the notification target.
    Type string
    The type of notification target: email, slack, atMention, or case.
    handle string
    The handle of the notification target.
    type string
    The type of notification target: email, slack, atMention, or case.
    handle String
    The handle of the notification target.
    type String
    The type of notification target: email, slack, atMention, or case.
    handle string
    The handle of the notification target.
    type string
    The type of notification target: email, slack, atMention, or case.
    handle str
    The handle of the notification target.
    type str
    The type of notification target: email, slack, atMention, or case.
    handle String
    The handle of the notification target.
    type String
    The type of notification target: email, slack, atMention, or case.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import datadog:index/governanceControl:GovernanceControl unused_api_keys unused_api_keys

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Viewing docs for Datadog v5.11.0
    published on Tuesday, Sep 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-datadog

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial