🔷 Dynatrace Email Notification Terraform Module

Manages a single Dynatrace email problem-notification configuration (dynatrace_email_notification) — recipients, subject/body templates, and the alerting profile it attaches to — for provider dynatrace-oss/dynatrace ~> 1.98.

• Manages exactly one dynatrace_email_notification resource — a Settings 2.0-backed problem notification channel (schemaId builtin:problem.notifications).
• Configures the primary (to), carbon-copy (cc), and blind-carbon-copy (bcc) recipient sets, each a set(string) of email addresses.
• Configures the subject and body templates using Dynatrace's problem-notification placeholder syntax ({ProblemTitle}, {ProblemDetailsText}, {State}, etc.).
• Attaches to an existing alerting profile by ID via the profile input — this module never creates or manages the alerting profile itself.
• Ships secure by default: active defaults to false, so a newly-applied integration cannot send email until a caller explicitly reviews and enables it.

💡 Why it matters: email is frequently the fallback notification channel every Dynatrace environment configures first, and often the one every team assumes "just works" once wired to a distribution list. A typed set(string) recipient model and a secure-by-default active flag turn two common failure modes — a typo'd recipient string silently accepted at plan time, and a freshly applied channel paging people before its content has been reviewed — into either a type error the planner catches or a deliberate opt-in the caller has to type.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 AP["terraform-dynatrace-alerting-profile"]:::sibling
 EN["terraform-dynatrace-email-notification"]:::thismodule
 RES["dynatrace_email_notification"]:::keystone

 AP -- "id → profile" --> EN
 EN -- "provisions" --> RES

 classDef thismodule fill:#1496FF,color:#FFFFFF,stroke:#0A2540,stroke-width:1px;
 classDef keystone fill:#0A2540,color:#FFFFFF,stroke:#0A2540,stroke-width:1px;
 classDef sibling fill:#E5E7EB,color:#0A2540,stroke:#9CA3AF,stroke-width:1px;

This module consumes an alerting profile's id output (from terraform-dynatrace-alerting-profile) and provisions the email notification channel that fires against it. It has no children of its own and no other sibling module consumes its outputs by id — it sits at the end of the notification-channel family's dependency chain, not in the middle of it. (Diagram validated via the Mermaid Chart MCP — valid: true.)

flowchart LR
 subgraph Inputs["Inputs (variables.tf)"]
 name["name"]
 profile["profile"]
 subject["subject"]
 body["body"]
 to["to"]
 cc["cc"]
 bcc["bcc"]
 ncp["notify_closed_problems"]
 active["active"]
 end

 RES["dynatrace_email_notification.this"]:::keystone

 name --> RES
 profile --> RES
 subject --> RES
 body --> RES
 to --> RES
 cc --> RES
 bcc --> RES
 ncp --> RES
 active --> RES

 RES -- "id" --> OUT_ID["output: id"]
 RES -- "name" --> OUT_NAME["output: name"]

 classDef keystone fill:#0A2540,color:#FFFFFF,stroke:#0A2540,stroke-width:1px;

(Diagram validated via the Mermaid Chart MCP — valid: true.)

Resource inventory:

• dynatrace_email_notification.this — the sole resource. No for_each-driven children, no nested dynamic blocks — the live schema for this resource has no block_types at all, so main.tf is a direct, flat 1:1 attribute pass-through.

Schema notes that bite:

• This is the only channel in the notification family with no provider-flagged sensitive fields. Confirmed against the live schema: dynatrace_email_notification has no secret/token/webhook-URL attribute of any kind — recipients are plain email-address strings. Contrast with sibling channels such as Slack (webhook URL), PagerDuty/OpsGenie (integration key), or ServiceNow (credentials), each of which carries at least one field this house standard requires treating as sensitive.
• active has no provider-documented default — this module defaults the variable to false so a newly-applied integration does not fire before review. This is a module-level secure default, not a provider default; the provider itself simply leaves the behavior undocumented when the argument is entirely absent.
• to is required and typed set(string) (the provider's own TypeSet of strings) — not a list, and not a comma-joined string. Order is not significant and duplicate addresses within the same field are collapsed by Terraform before the resource is ever created or updated.
• cc and bcc are optional, also typed set(string), and default to [] in this module — omitting them produces no CC/BCC recipients, matching the provider's own "absent means none" behavior.
• subject and body are both confirmed required strings on the live schema — an earlier scaffolding assumption that body might be optional does not hold; there is no fallback template.
• notify_closed_problems is optional with no provider-documented default; this module leaves it at null, which omits the argument from the rendered resource block entirely rather than guessing true or false. Verify the resulting server-side behavior in a non-production environment if deterministic open/close notification behavior matters, and set it explicitly rather than relying on the omission.
• The resource also exposes a computed legacy_id attribute (its Config API V1 cross-reference id). This module does not surface it as an output — it is provider interop metadata, not a caller-facing value.

This module manages dynatrace_email_notification, a Settings 2.0-backed resource. It accepts either OAuth client credentials or a legacy API token.

• API token (confirmed via the live provider documentation, v1.100.0): the provider's own resource page states explicitly — "This resource requires the API token scopes Read settings (settings.read) and Write settings (settings.write)." Grant a legacy API token exactly these two scopes.
• OAuth (recommended): grant the OAuth client's IAM policy the equivalent Settings 2.0 scope pair, settings:objects:read and settings:objects:write, consistent with this domain's other Settings-2.0-backed resources (e.g. dynatrace_alerting, which documents the identical settings.read/settings.write API-token scope pair at the same provider version). The provider's resource-level page for dynatrace_email_notification documents only the API-token scope names explicitly — the OAuth scope-pair mapping follows this module suite's general Settings 2.0 auth convention rather than an explicit per-resource OAuth scope list in the provider's own docs. Verify against your environment's IAM policy model before a production apply.
• This module does not touch IAM or Automation resources, so no account-idm-* or automation:* scopes are required.

• An OAuth client (or legacy API token) provisioned with the scopes/permissions above, bound via an IAM policy (OAuth) or token permissions (API token).
• The target alerting profile must already exist (or be created in the same plan via an implicit reference to a terraform-dynatrace-alerting-profile instance's id output) — this module only references it by id and does not create or manage it.
• Settings 2.0 schema availability (builtin:problem.notifications) for the target environment tier.

terraform-dynatrace-email-notification/
├── providers.tf # required_version, required_providers pin — no provider {} block
├── variables.tf # name, profile, subject, body, to, cc, bcc, notify_closed_problems, active
├── main.tf # dynatrace_email_notification.this — thin, total, single-resource renderer
├── outputs.tf # id, name
├── README.md # this file
├── SCOPE.md # lightweight cross-module contract
└── examples/
 └── quickstart/
 └── main.tf

module "email_notification" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Critical Problems"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71" # existing dynatrace_alerting profile ID
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["oncall-platform@example.com"]
}

The caller configures the dynatrace provider (OAuth client credentials, platform token, or legacy API token, plus dt_env_url) once, outside this module. This module declares no provider {} block and no auth-related variables.

Consumes

Emits

module "email_notification_inert" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Critical Problems"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71" # existing dynatrace_alerting profile ID
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["oncall-platform@example.com"]
}

module "email_notification_active" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Critical Problems"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["oncall-platform@example.com"]
  active  = true
}

module "email_notification_multi_recipient" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Critical Problems (Escalation)"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["oncall-platform@example.com", "sre-team@example.com"]
  cc      = ["escalation-manager@example.com"]
  bcc     = ["compliance-archive@example.com"]
  active  = true
}

module "email_notification_distribution_list" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Data Platform - Critical Problems"
  profile = "0987654321fedcba0987654321fedcba"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["data-platform-oncall@example.com"]
  active  = true
}

module "email_notification_notify_on_close" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name                   = "Email - Platform Team - Problem Lifecycle"
  profile                = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject                = "[{State}] {ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body                   = "{ProblemDetailsText}"
  to                     = ["oncall-platform@example.com"]
  notify_closed_problems = true
  active                 = true
}

module "email_notification_open_only" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name                   = "Email - Platform Team - Open Problems Only"
  profile                = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject                = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body                   = "{ProblemDetailsText}"
  to                     = ["oncall-platform@example.com"]
  notify_closed_problems = false
  active                 = true
}

module "email_notification_compliance_archive" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Core Banking Platform - Critical Problems"
  profile = "3fa1c9d2b7e04a6f8c5d1e2a9b7c4f60"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["core-banking-oncall@example.com"]
  bcc     = ["compliance-archive@example.com"]
  active  = true
}

module "email_notification_triage_subject" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Triage"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject = "{ProblemSeverity}/{ProblemImpact}: {ImpactedEntity} — {ProblemTitle} ({ProblemID})"
  body    = "{ProblemDetailsText}"
  to      = ["oncall-platform@example.com"]
  active  = true
}

module "email_notification_json_body" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Automation Pipeline - Problem Feed"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsJSONv2}"
  to      = ["problem-feed-parser@example.com"]
  active  = true
}

module "email_notification_markdown_body" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Markdown Digest"
  profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsMarkdown}"
  to      = ["oncall-platform@example.com"]
  active  = true
}

module "email_notification_escalation_cc" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Payments Platform - Critical Problems"
  profile = "7c2e9f14a8b3d05e6f1a2c3b4d5e6f70"
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["payments-oncall@example.com"]
  cc      = ["payments-eng-manager@example.com", "payments-duty-manager@example.com"]
  active  = true
}

locals {
  environments = {
    prod = {
      name    = "Email - Platform Team - Production Critical Problems"
      profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
      to      = ["oncall-platform@example.com"]
      active  = true
    }
    nonprod = {
      name    = "Email - Platform Team - Non-Production Problems"
      profile = "b4a6c8d0e2f4a6c8d0e2f4a6c8d0e2f4"
      to      = ["platform-team@example.com"]
      active  = false # reviewed on a slower cadence; left inert until confirmed
    }
  }
}

module "email_notification_by_environment" {
  for_each = local.environments
  source   = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = each.value.name
  profile = each.value.profile
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = each.value.to
  active  = each.value.active
}

locals {
  team_channels = {
    platform = {
      profile = "e5d24d1e-de08-4738-89bd-1a1dc9377b71"
      to      = ["oncall-platform@example.com"]
    }
    data = {
      profile = "0987654321fedcba0987654321fedcba"
      to      = ["oncall-data@example.com"]
    }
    payments = {
      profile = "7c2e9f14a8b3d05e6f1a2c3b4d5e6f70"
      to      = ["payments-oncall@example.com"]
    }
  }
}

module "team_email_notifications" {
  for_each = local.team_channels
  source   = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - ${title(each.key)} Team - Critical Problems"
  profile = each.value.profile
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = each.value.to
  active  = true
}

module "email_notification_required_only" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Sandbox - Test Notification"
  profile = "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d"
  subject = "{ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["sandbox-test@example.com"]
}

module "critical_availability_profile" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-alerting-profile.git?ref=v1.0.0"

  name = "Critical Availability - Platform"

  rules = {
    availability-all-entities = {
      severity_level   = "AVAILABILITY"
      include_mode     = "INCLUDE_ALL"
      delay_in_minutes = 5
      tags             = ["Team:platform", "Environment:production"]
    }
  }
}

module "platform_email_notification" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-email-notification.git?ref=v1.0.0"

  name    = "Email - Platform Team - Critical Availability"
  profile = module.critical_availability_profile.id
  subject = "{ProblemSeverity} problem {ProblemID}: {ProblemTitle}"
  body    = "{ProblemDetailsText}"
  to      = ["oncall-platform@example.com"]
  cc      = ["escalation-manager@example.com"]
  active  = true
}

• Flat, single-resource renderer. The live schema for dynatrace_email_notification has no nested block_types, so main.tf is a direct attribute-to-argument pass-through with no dynamic blocks and no try(x, null) wrapping needed beyond what the variable defaults already provide.
• to/cc/bcc are sets, not lists. They mirror the provider's own TypeSet type. Order carries no meaning in either direction, and Terraform deduplicates entries within each field before they reach the API — do not build automation that depends on recipient ordering being preserved.
• profile is a plain cross-module string reference. This module does not depends_on the alerting profile; wiring module.<alerting_profile>.id directly into profile (see Example 15) gives Terraform an implicit reference so the profile is always created or updated first.
• active false is a module-level default, not a provider default. The provider leaves this field's behavior undocumented when entirely absent from the resource block; this module makes the choice explicit by rendering active = false unless the caller opts in.
• notify_closed_problems left null is deliberate, not an oversight. Per house guidance for undocumented provider defaults, the module does not invent a plausible-sounding default — it omits the argument and defers to the Dynatrace API's own server-side behavior when unset.
• No credential-bearing fields exist on this resource at all — unlike sibling notification-channel modules (Slack, webhook, PagerDuty, OpsGenie, ServiceNow, etc.), there is no sensitive = true variable in this module because there is no secret-shaped attribute in the underlying provider schema to protect.
• No owned children, no for_each inside this module. Breadth at scale (multiple teams, environments, or channels) is achieved by the calling root module for_each-ing this module block itself, keyed by a caller-chosen map key — see Examples 12 and 13.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module source to an explicit tag — ?ref=v1.0.0 — never a branch. This library is plan-only: a human applies from CI after reviewing the plan.

terraform validate and terraform fmt -check prove the module's HCL is syntactically well-formed, that every required variable is supplied, that to/cc/bcc type-check as set(string) (rejecting a comma-joined string or a list literal with mismatched element types), and that the resource graph resolves. They do not prove that a given profile ID exists in the target environment, that the configured OAuth client or API token actually carries the settings.read/settings.write scopes, that Dynatrace accepts the literal email address strings supplied, or that subject/body placeholder syntax resolves the way the caller expects — those are only exercised by a real terraform plan/apply against a live Dynatrace environment, which this authoring process does not perform.

$ terraform output

id = "vu9U3hXa3q0AAAAA"
name = "Email - Platform Team - Critical Availability"

• Dynatrace provider resource reference: dynatrace_email_notification (dynatrace-oss/dynatrace, schemaId builtin:problem.notifications)
• Sibling module: terraform-dynatrace-alerting-profile (owns the profile this module references)
• Sibling notification-channel modules in this domain: terraform-dynatrace-slack-notification, terraform-dynatrace-webhook-notification, terraform-dynatrace-pagerduty-notification, terraform-dynatrace-ops-genie-notification, terraform-dynatrace-servicenow-notification, terraform-dynatrace-jira-notification, terraform-dynatrace-trello-notification, terraform-dynatrace-victorops-notification, terraform-dynatrace-xmatters-notification, terraform-dynatrace-ansible-tower-notification
• This module's SCOPE.md

💙 "Infrastructure as Code should be standardized, consistent, and secure."