Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Datadog Provider
  4. API Docs
  5. TagRule
Viewing docs for Datadog v5.11.0
published on Tuesday, Sep 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

datadog.TagRule

datadog logo
Viewing docs for Datadog v5.11.0
published on Tuesday, Sep 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

    Provides a Datadog tag rule resource. This can be used to create and manage Datadog governance tag rules.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

// Create a surfacing tag rule, which highlights non-compliant telemetry
// without rejecting it.
const env = new datadog.TagRule("env", {
    name: "env must be a known environment",
    source: "logs",
    scope: "org",
    tagKey: "env",
    tagValuePatterns: [
        "prod",
        "staging",
        "dev",
    ],
    ruleType: "surfacing",
    required: true,
});
// Create a blocking tag rule, which rejects telemetry that violates it.
// The Datadog API only accepts `surfacing` at creation time, so the provider
// creates the rule and then immediately updates it to `blocking`. Because that
// makes the create non-atomic, it has to be opted into explicitly.
const service = new datadog.TagRule("service", {
    name: "service must be lowercase and hyphenated",
    source: "spans",
    scope: "org",
    tagKey: "service",
    tagValuePatterns: ["web-*"],
    ruleType: "blocking",
    forceBlockingOnCreate: true,
    hardDelete: false,
});

    import pulumi
import pulumi_datadog as datadog

# Create a surfacing tag rule, which highlights non-compliant telemetry
# without rejecting it.
env = datadog.TagRule("env",
    name="env must be a known environment",
    source="logs",
    scope="org",
    tag_key="env",
    tag_value_patterns=[
        "prod",
        "staging",
        "dev",
    ],
    rule_type="surfacing",
    required=True)
# Create a blocking tag rule, which rejects telemetry that violates it.
# The Datadog API only accepts `surfacing` at creation time, so the provider
# creates the rule and then immediately updates it to `blocking`. Because that
# makes the create non-atomic, it has to be opted into explicitly.
service = datadog.TagRule("service",
    name="service must be lowercase and hyphenated",
    source="spans",
    scope="org",
    tag_key="service",
    tag_value_patterns=["web-*"],
    rule_type="blocking",
    force_blocking_on_create=True,
    hard_delete=False)

    package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create a surfacing tag rule, which highlights non-compliant telemetry
		// without rejecting it.
		_, err := datadog.NewTagRule(ctx, "env", &datadog.TagRuleArgs{
			Name:   pulumi.String("env must be a known environment"),
			Source: pulumi.String("logs"),
			Scope:  pulumi.String("org"),
			TagKey: pulumi.String("env"),
			TagValuePatterns: pulumi.StringArray{
				pulumi.String("prod"),
				pulumi.String("staging"),
				pulumi.String("dev"),
			},
			RuleType: pulumi.String("surfacing"),
			Required: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		// Create a blocking tag rule, which rejects telemetry that violates it.
		// The Datadog API only accepts `surfacing` at creation time, so the provider
		// creates the rule and then immediately updates it to `blocking`. Because that
		// makes the create non-atomic, it has to be opted into explicitly.
		_, err = datadog.NewTagRule(ctx, "service", &datadog.TagRuleArgs{
			Name:   pulumi.String("service must be lowercase and hyphenated"),
			Source: pulumi.String("spans"),
			Scope:  pulumi.String("org"),
			TagKey: pulumi.String("service"),
			TagValuePatterns: pulumi.StringArray{
				pulumi.String("web-*"),
			},
			RuleType:              pulumi.String("blocking"),
			ForceBlockingOnCreate: pulumi.Bool(true),
			HardDelete:            pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    // Create a surfacing tag rule, which highlights non-compliant telemetry
    // without rejecting it.
    var env = new Datadog.TagRule("env", new()
    {
        Name = "env must be a known environment",
        Source = "logs",
        Scope = "org",
        TagKey = "env",
        TagValuePatterns = new[]
        {
            "prod",
            "staging",
            "dev",
        },
        RuleType = "surfacing",
        Required = true,
    });

    // Create a blocking tag rule, which rejects telemetry that violates it.
    // The Datadog API only accepts `surfacing` at creation time, so the provider
    // creates the rule and then immediately updates it to `blocking`. Because that
    // makes the create non-atomic, it has to be opted into explicitly.
    var service = new Datadog.TagRule("service", new()
    {
        Name = "service must be lowercase and hyphenated",
        Source = "spans",
        Scope = "org",
        TagKey = "service",
        TagValuePatterns = new[]
        {
            "web-*",
        },
        RuleType = "blocking",
        ForceBlockingOnCreate = true,
        HardDelete = false,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.TagRule;
import com.pulumi.datadog.TagRuleArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create a surfacing tag rule, which highlights non-compliant telemetry
        // without rejecting it.
        var env = new TagRule("env", TagRuleArgs.builder()
            .name("env must be a known environment")
            .source("logs")
            .scope("org")
            .tagKey("env")
            .tagValuePatterns(            
                "prod",
                "staging",
                "dev")
            .ruleType("surfacing")
            .required(true)
            .build());

        // Create a blocking tag rule, which rejects telemetry that violates it.
        // The Datadog API only accepts `surfacing` at creation time, so the provider
        // creates the rule and then immediately updates it to `blocking`. Because that
        // makes the create non-atomic, it has to be opted into explicitly.
        var service = new TagRule("service", TagRuleArgs.builder()
            .name("service must be lowercase and hyphenated")
            .source("spans")
            .scope("org")
            .tagKey("service")
            .tagValuePatterns("web-*")
            .ruleType("blocking")
            .forceBlockingOnCreate(true)
            .hardDelete(false)
            .build());

    }
}

    resources:
  # Create a surfacing tag rule, which highlights non-compliant telemetry
  # without rejecting it.
  env:
    type: datadog:TagRule
    properties:
      name: env must be a known environment
      source: logs
      scope: org
      tagKey: env
      tagValuePatterns:
        - prod
        - staging
        - dev
      ruleType: surfacing
      required: true
  # Create a blocking tag rule, which rejects telemetry that violates it.
  # The Datadog API only accepts `surfacing` at creation time, so the provider
  # creates the rule and then immediately updates it to `blocking`. Because that
  # makes the create non-atomic, it has to be opted into explicitly.
  service:
    type: datadog:TagRule
    properties:
      name: service must be lowercase and hyphenated
      source: spans
      scope: org
      tagKey: service
      tagValuePatterns:
        - web-*
      ruleType: blocking
      forceBlockingOnCreate: true # Keep the rule recoverable and preserve its historical compliance score
      #   # data when this resource is destroyed.
      hardDelete: false

    pulumi {
  required_providers {
    datadog = {
      source = "pulumi/datadog"
    }
  }
}

# Create a surfacing tag rule, which highlights non-compliant telemetry
# without rejecting it.
resource "datadog_tagrule" "env" {
  name               = "env must be a known environment"
  source             = "logs"
  scope              = "org"
  tag_key            = "env"
  tag_value_patterns = ["prod", "staging", "dev"]
  rule_type          = "surfacing"
  required           = true
}
# Create a blocking tag rule, which rejects telemetry that violates it.
# The Datadog API only accepts `surfacing` at creation time, so the provider
# creates the rule and then immediately updates it to `blocking`. Because that
# makes the create non-atomic, it has to be opted into explicitly.
resource "datadog_tagrule" "service" {
  name                     = "service must be lowercase and hyphenated"
  source                   = "spans"
  scope                    = "org"
  tag_key                  = "service"
  tag_value_patterns       = ["web-*"]
  rule_type                = "blocking"
  force_blocking_on_create = true
  # Keep the rule recoverable and preserve its historical compliance score
  # data when this resource is destroyed.
  hard_delete = false
}

    Create TagRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new TagRule(name: string, args: TagRuleArgs, opts?: CustomResourceOptions);
    @overload
def TagRule(resource_name: str,
            args: TagRuleArgs,
            opts: Optional[ResourceOptions] = None)

@overload
def TagRule(resource_name: str,
            opts: Optional[ResourceOptions] = None,
            name: Optional[str] = None,
            rule_type: Optional[str] = None,
            scope: Optional[str] = None,
            source: Optional[str] = None,
            tag_key: Optional[str] = None,
            tag_value_patterns: Optional[Sequence[str]] = None,
            enabled: Optional[bool] = None,
            force_blocking_on_create: Optional[bool] = None,
            hard_delete: Optional[bool] = None,
            negated: Optional[bool] = None,
            required: Optional[bool] = None)
    func NewTagRule(ctx *Context, name string, args TagRuleArgs, opts ...ResourceOption) (*TagRule, error)
    public TagRule(string name, TagRuleArgs args, CustomResourceOptions? opts = null)
    public TagRule(String name, TagRuleArgs args)
public TagRule(String name, TagRuleArgs args, CustomResourceOptions options)

    type: datadog:TagRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "datadog_tag_rule" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args TagRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args TagRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args TagRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args TagRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args TagRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var tagRuleResource = new Datadog.TagRule("tagRuleResource", new()
{
    Name = "string",
    RuleType = "string",
    Scope = "string",
    Source = "string",
    TagKey = "string",
    TagValuePatterns = new[]
    {
        "string",
    },
    Enabled = false,
    ForceBlockingOnCreate = false,
    HardDelete = false,
    Negated = false,
    Required = false,
});

    example, err := datadog.NewTagRule(ctx, "tagRuleResource", &datadog.TagRuleArgs{
	Name:     pulumi.String("string"),
	RuleType: pulumi.String("string"),
	Scope:    pulumi.String("string"),
	Source:   pulumi.String("string"),
	TagKey:   pulumi.String("string"),
	TagValuePatterns: pulumi.StringArray{
		pulumi.String("string"),
	},
	Enabled:               pulumi.Bool(false),
	ForceBlockingOnCreate: pulumi.Bool(false),
	HardDelete:            pulumi.Bool(false),
	Negated:               pulumi.Bool(false),
	Required:              pulumi.Bool(false),
})

    resource "datadog_tag_rule" "tagRuleResource" {
  lifecycle {
    create_before_destroy = true
  }
  name                     = "string"
  rule_type                = "string"
  scope                    = "string"
  source                   = "string"
  tag_key                  = "string"
  tag_value_patterns       = ["string"]
  enabled                  = false
  force_blocking_on_create = false
  hard_delete              = false
  negated                  = false
  required                 = false
}

    var tagRuleResource = new TagRule("tagRuleResource", TagRuleArgs.builder()
    .name("string")
    .ruleType("string")
    .scope("string")
    .source("string")
    .tagKey("string")
    .tagValuePatterns("string")
    .enabled(false)
    .forceBlockingOnCreate(false)
    .hardDelete(false)
    .negated(false)
    .required(false)
    .build());

    tag_rule_resource = datadog.TagRule("tagRuleResource",
    name="string",
    rule_type="string",
    scope="string",
    source="string",
    tag_key="string",
    tag_value_patterns=["string"],
    enabled=False,
    force_blocking_on_create=False,
    hard_delete=False,
    negated=False,
    required=False)

    const tagRuleResource = new datadog.TagRule("tagRuleResource", {
    name: "string",
    ruleType: "string",
    scope: "string",
    source: "string",
    tagKey: "string",
    tagValuePatterns: ["string"],
    enabled: false,
    forceBlockingOnCreate: false,
    hardDelete: false,
    negated: false,
    required: false,
});

    type: datadog:TagRule
properties:
    enabled: false
    forceBlockingOnCreate: false
    hardDelete: false
    name: string
    negated: false
    required: false
    ruleType: string
    scope: string
    source: string
    tagKey: string
    tagValuePatterns:
        - string

    TagRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The TagRule resource accepts the following input properties:

    Name string
    Human-readable name for the tag rule.
    RuleType string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    Scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    Source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    TagKey string
    The tag key that the rule governs (for example, service).
    TagValuePatterns List<string>
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    Enabled bool
    Whether the rule is currently enforced. Defaults to true.
    ForceBlockingOnCreate bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    HardDelete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    Negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    Required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    Name string
    Human-readable name for the tag rule.
    RuleType string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    Scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    Source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    TagKey string
    The tag key that the rule governs (for example, service).
    TagValuePatterns []string
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    Enabled bool
    Whether the rule is currently enforced. Defaults to true.
    ForceBlockingOnCreate bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    HardDelete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    Negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    Required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    name string
    Human-readable name for the tag rule.
    rule_type string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tag_key string
    The tag key that the rule governs (for example, service).
    tag_value_patterns list(string)
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    enabled bool
    Whether the rule is currently enforced. Defaults to true.
    force_blocking_on_create bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hard_delete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    name String
    Human-readable name for the tag rule.
    ruleType String
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope String
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source String
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tagKey String
    The tag key that the rule governs (for example, service).
    tagValuePatterns List<String>
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    enabled Boolean
    Whether the rule is currently enforced. Defaults to true.
    forceBlockingOnCreate Boolean
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hardDelete Boolean
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    negated Boolean
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required Boolean
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    name string
    Human-readable name for the tag rule.
    ruleType string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tagKey string
    The tag key that the rule governs (for example, service).
    tagValuePatterns string[]
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    enabled boolean
    Whether the rule is currently enforced. Defaults to true.
    forceBlockingOnCreate boolean
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hardDelete boolean
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    negated boolean
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required boolean
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    name str
    Human-readable name for the tag rule.
    rule_type str
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope str
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source str
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tag_key str
    The tag key that the rule governs (for example, service).
    tag_value_patterns Sequence[str]
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    enabled bool
    Whether the rule is currently enforced. Defaults to true.
    force_blocking_on_create bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hard_delete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    name String
    Human-readable name for the tag rule.
    ruleType String
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope String
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source String
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tagKey String
    The tag key that the rule governs (for example, service).
    tagValuePatterns List<String>
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    enabled Boolean
    Whether the rule is currently enforced. Defaults to true.
    forceBlockingOnCreate Boolean
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hardDelete Boolean
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    negated Boolean
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required Boolean
    When true, telemetry without this tag is treated as a violation. Defaults to false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the TagRule resource produces the following output properties:

    CreatedAt string
    The RFC 3339 timestamp at which the rule was created.
    CreatedBy string
    The identifier of the user who created the rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    ModifiedAt string
    The RFC 3339 timestamp at which the rule was last modified.
    ModifiedBy string
    The identifier of the user who last modified the rule.
    Version int
    A monotonically increasing version counter that is incremented on each update.
    CreatedAt string
    The RFC 3339 timestamp at which the rule was created.
    CreatedBy string
    The identifier of the user who created the rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    ModifiedAt string
    The RFC 3339 timestamp at which the rule was last modified.
    ModifiedBy string
    The identifier of the user who last modified the rule.
    Version int
    A monotonically increasing version counter that is incremented on each update.
    created_at string
    The RFC 3339 timestamp at which the rule was created.
    created_by string
    The identifier of the user who created the rule.
    id string
    The provider-assigned unique ID for this managed resource.
    modified_at string
    The RFC 3339 timestamp at which the rule was last modified.
    modified_by string
    The identifier of the user who last modified the rule.
    version number
    A monotonically increasing version counter that is incremented on each update.
    createdAt String
    The RFC 3339 timestamp at which the rule was created.
    createdBy String
    The identifier of the user who created the rule.
    id String
    The provider-assigned unique ID for this managed resource.
    modifiedAt String
    The RFC 3339 timestamp at which the rule was last modified.
    modifiedBy String
    The identifier of the user who last modified the rule.
    version Integer
    A monotonically increasing version counter that is incremented on each update.
    createdAt string
    The RFC 3339 timestamp at which the rule was created.
    createdBy string
    The identifier of the user who created the rule.
    id string
    The provider-assigned unique ID for this managed resource.
    modifiedAt string
    The RFC 3339 timestamp at which the rule was last modified.
    modifiedBy string
    The identifier of the user who last modified the rule.
    version number
    A monotonically increasing version counter that is incremented on each update.
    created_at str
    The RFC 3339 timestamp at which the rule was created.
    created_by str
    The identifier of the user who created the rule.
    id str
    The provider-assigned unique ID for this managed resource.
    modified_at str
    The RFC 3339 timestamp at which the rule was last modified.
    modified_by str
    The identifier of the user who last modified the rule.
    version int
    A monotonically increasing version counter that is incremented on each update.
    createdAt String
    The RFC 3339 timestamp at which the rule was created.
    createdBy String
    The identifier of the user who created the rule.
    id String
    The provider-assigned unique ID for this managed resource.
    modifiedAt String
    The RFC 3339 timestamp at which the rule was last modified.
    modifiedBy String
    The identifier of the user who last modified the rule.
    version Number
    A monotonically increasing version counter that is incremented on each update.

    Look up Existing TagRule Resource

    Get an existing TagRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: TagRuleState, opts?: CustomResourceOptions): TagRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        created_at: Optional[str] = None,
        created_by: Optional[str] = None,
        enabled: Optional[bool] = None,
        force_blocking_on_create: Optional[bool] = None,
        hard_delete: Optional[bool] = None,
        modified_at: Optional[str] = None,
        modified_by: Optional[str] = None,
        name: Optional[str] = None,
        negated: Optional[bool] = None,
        required: Optional[bool] = None,
        rule_type: Optional[str] = None,
        scope: Optional[str] = None,
        source: Optional[str] = None,
        tag_key: Optional[str] = None,
        tag_value_patterns: Optional[Sequence[str]] = None,
        version: Optional[int] = None) -> TagRule
    func GetTagRule(ctx *Context, name string, id IDInput, state *TagRuleState, opts ...ResourceOption) (*TagRule, error)
    public static TagRule Get(string name, Input<string> id, TagRuleState? state, CustomResourceOptions? opts = null)
    public static TagRule get(String name, Output<String> id, TagRuleState state, CustomResourceOptions options)
    resources:  _:    type: datadog:TagRule    get:      id: ${id}
    import {
  to = datadog_tag_rule.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreatedAt string
    The RFC 3339 timestamp at which the rule was created.
    CreatedBy string
    The identifier of the user who created the rule.
    Enabled bool
    Whether the rule is currently enforced. Defaults to true.
    ForceBlockingOnCreate bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    HardDelete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    ModifiedAt string
    The RFC 3339 timestamp at which the rule was last modified.
    ModifiedBy string
    The identifier of the user who last modified the rule.
    Name string
    Human-readable name for the tag rule.
    Negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    Required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    RuleType string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    Scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    Source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    TagKey string
    The tag key that the rule governs (for example, service).
    TagValuePatterns List<string>
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    Version int
    A monotonically increasing version counter that is incremented on each update.
    CreatedAt string
    The RFC 3339 timestamp at which the rule was created.
    CreatedBy string
    The identifier of the user who created the rule.
    Enabled bool
    Whether the rule is currently enforced. Defaults to true.
    ForceBlockingOnCreate bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    HardDelete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    ModifiedAt string
    The RFC 3339 timestamp at which the rule was last modified.
    ModifiedBy string
    The identifier of the user who last modified the rule.
    Name string
    Human-readable name for the tag rule.
    Negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    Required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    RuleType string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    Scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    Source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    TagKey string
    The tag key that the rule governs (for example, service).
    TagValuePatterns []string
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    Version int
    A monotonically increasing version counter that is incremented on each update.
    created_at string
    The RFC 3339 timestamp at which the rule was created.
    created_by string
    The identifier of the user who created the rule.
    enabled bool
    Whether the rule is currently enforced. Defaults to true.
    force_blocking_on_create bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hard_delete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    modified_at string
    The RFC 3339 timestamp at which the rule was last modified.
    modified_by string
    The identifier of the user who last modified the rule.
    name string
    Human-readable name for the tag rule.
    negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    rule_type string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tag_key string
    The tag key that the rule governs (for example, service).
    tag_value_patterns list(string)
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    version number
    A monotonically increasing version counter that is incremented on each update.
    createdAt String
    The RFC 3339 timestamp at which the rule was created.
    createdBy String
    The identifier of the user who created the rule.
    enabled Boolean
    Whether the rule is currently enforced. Defaults to true.
    forceBlockingOnCreate Boolean
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hardDelete Boolean
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    modifiedAt String
    The RFC 3339 timestamp at which the rule was last modified.
    modifiedBy String
    The identifier of the user who last modified the rule.
    name String
    Human-readable name for the tag rule.
    negated Boolean
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required Boolean
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    ruleType String
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope String
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source String
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tagKey String
    The tag key that the rule governs (for example, service).
    tagValuePatterns List<String>
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    version Integer
    A monotonically increasing version counter that is incremented on each update.
    createdAt string
    The RFC 3339 timestamp at which the rule was created.
    createdBy string
    The identifier of the user who created the rule.
    enabled boolean
    Whether the rule is currently enforced. Defaults to true.
    forceBlockingOnCreate boolean
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hardDelete boolean
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    modifiedAt string
    The RFC 3339 timestamp at which the rule was last modified.
    modifiedBy string
    The identifier of the user who last modified the rule.
    name string
    Human-readable name for the tag rule.
    negated boolean
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required boolean
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    ruleType string
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope string
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source string
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tagKey string
    The tag key that the rule governs (for example, service).
    tagValuePatterns string[]
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    version number
    A monotonically increasing version counter that is incremented on each update.
    created_at str
    The RFC 3339 timestamp at which the rule was created.
    created_by str
    The identifier of the user who created the rule.
    enabled bool
    Whether the rule is currently enforced. Defaults to true.
    force_blocking_on_create bool
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hard_delete bool
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    modified_at str
    The RFC 3339 timestamp at which the rule was last modified.
    modified_by str
    The identifier of the user who last modified the rule.
    name str
    Human-readable name for the tag rule.
    negated bool
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required bool
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    rule_type str
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope str
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source str
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tag_key str
    The tag key that the rule governs (for example, service).
    tag_value_patterns Sequence[str]
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    version int
    A monotonically increasing version counter that is incremented on each update.
    createdAt String
    The RFC 3339 timestamp at which the rule was created.
    createdBy String
    The identifier of the user who created the rule.
    enabled Boolean
    Whether the rule is currently enforced. Defaults to true.
    forceBlockingOnCreate Boolean
    Set to true to allow creating a rule with ruleType set to blocking. The Datadog API only accepts surfacing at creation time, so the provider creates the rule as surfacing and then immediately updates it to blocking, which makes the create non-atomic: if the update fails, a surfacing rule is left behind and the resource is marked tainted. This field is only read during creation and is not sent to the API; changing it afterwards produces a diff that has no effect.
    hardDelete Boolean
    Whether destroying this resource permanently deletes the tag rule. When set to false the rule is soft-deleted instead, which keeps it recoverable and preserves its historical compliance score data. This field is only read during deletion and is not sent to the API on create or update. Defaults to true.
    modifiedAt String
    The RFC 3339 timestamp at which the rule was last modified.
    modifiedBy String
    The identifier of the user who last modified the rule.
    name String
    Human-readable name for the tag rule.
    negated Boolean
    When true, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to false.
    required Boolean
    When true, telemetry without this tag is treated as a violation. Defaults to false.
    ruleType String
    How the rule is enforced. surfacing only highlights non-compliant telemetry, while blocking rejects telemetry that violates the rule. The API only accepts surfacing at creation time, so creating a rule directly as blocking requires forceBlockingOnCreate to be set to true. Using blocking at all requires blocking tag rules to be enabled for your organization; otherwise the API returns 403 permission denied. Valid values are blocking, surfacing.
    scope String
    The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced.
    source String
    The telemetry source that the tag rule applies to. This field cannot be updated after creation; changing it forces a new resource. Valid values are logs, spans, metrics, rum, feed.
    tagKey String
    The tag key that the rule governs (for example, service).
    tagValuePatterns List<String>
    One or more patterns that valid values for the tag key must match. At least one pattern is required. These are not regular expressions: the API restricts pattern characters to A-Za-z0-9_:-.,/*, with * acting as a wildcard. A pattern made up only of wildcards (for example a bare *) is rejected by the API.
    version Number
    A monotonically increasing version counter that is incremented on each update.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import datadog:index/tagRule:TagRule env "<rule_id>"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Viewing docs for Datadog v5.11.0
    published on Tuesday, Sep 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-datadog

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial