🔷 Dynatrace PagerDuty Notification Terraform Module

Manages a single dynatrace_pager_duty_notification Settings 2.0 integration, routing Dynatrace problem notifications for one alerting profile to one PagerDuty service. Targets dynatrace-oss/dynatrace ~> 1.98.

• 📟 Wires a Dynatrace alerting profile to a PagerDuty service via the PagerDuty Events API integration (dynatrace_pager_duty_notification).
• 🔒 Ships active = false by default — a newly-applied integration cannot page anyone until the caller explicitly reviews and opts in.
• 🔑 Treats the PagerDuty Events API key as caller-supplied, sensitive = true secret material — never a literal default, never re-exported as a module output.
• 🧩 Standalone primitive: one keystone resource (this), no owned children, no nested block types in the live schema. The only cross-module surface is consuming an alerting profile's id.

💡 Why it matters: PagerDuty is frequently the terminal on-call escalation path for production incidents at a regulated financial institution. A misconfigured or prematurely active integration either pages the wrong on-call rotation or silently fails to page anyone at all. This module makes the safe state — inactive, no literal secret in state or config — the effortless default, and requires the caller to type extra characters to reach the paging-enabled state.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

graph LR
 AP["terraform-dynatrace-alerting-profile"]:::sibling
 PD["terraform-dynatrace-pagerduty-notification"]:::this
 KEY["dynatrace_pager_duty_notification"]:::keystone
 EXT["PagerDuty (external service)"]:::sibling

 AP -- "id -> profile" --> PD
 PD -- "manages" --> KEY
 KEY -- "routes events to" --> EXT

 classDef this fill:#1496FF,color:#FFFFFF,stroke:#1496FF;
 classDef keystone fill:#0A2540,color:#FFFFFF,stroke:#0A2540;
 classDef sibling fill:#E5E7EB,color:#111111,stroke:#9CA3AF;

This module consumes exactly one sibling output — the id of a terraform-dynatrace-alerting-profile instance, via var.profile — and manages exactly one resource. It does not own, create, or manage the alerting profile itself, and PagerDuty's own account/service identifiers are external, PagerDuty-side concepts with no corresponding Terraform state anywhere in this module family.

graph TD
 subgraph Inputs
 NAME["name (required)"]
 PROFILE["profile (required)"]
 ACCOUNT["account (required)"]
 SERVICE["service (required)"]
 APIKEY["api_key (sensitive, optional)"]
 ACTIVE["active (optional, default false)"]
 end

 RES["dynatrace_pager_duty_notification.this"]:::keystone

 NAME --> RES
 PROFILE --> RES
 ACCOUNT --> RES
 SERVICE --> RES
 APIKEY --> RES
 ACTIVE --> RES

 RES --> OUT_ID["output: id"]
 RES --> OUT_NAME["output: name"]

 classDef keystone fill:#0A2540,color:#FFFFFF,stroke:#0A2540;

Resource inventory:

• dynatrace_pager_duty_notification.this — the sole resource. Flat attribute set (account, active, api_key, name, profile, service); no nested block_types, no for_each children. main.tf is a direct, total pass-through of every variable onto the resource — there is nothing here for a dynamic block to render.

Schema notes that bite:

• api_key is provider-flagged sensitive = true and is genuinely optional in the live schema — there is no documented provider-side default. This module mirrors both facts: the variable is declared sensitive = true with default = null, and outputs.tf omits any output derived from api_key entirely — it is never emitted, sensitive-marked or otherwise.
• active is required at the resource level in the live schema (no provider-side default exists for it), but this module supplies its own module-level default of false so that an omitted var.active still produces a fully valid plan, with the resource always receiving an explicit value. This is a deliberate secure-by-default choice, not an artifact of the schema.
• profile takes a raw string ID — this is a cross-module reference to a terraform-dynatrace-alerting-profile instance's id output, not a computed or nested object.
• The live schema also exposes a provider-computed legacy_id attribute (an interop cross-reference to the classic-API equivalent ID). This module deliberately excludes it from both variables.tf and outputs.tf — it is not a caller input, and this module does not add a passthrough output for it, consistent with the same judgment call made in the sibling terraform-dynatrace-alerting-profile module for its own legacy_id attribute on dynatrace_alerting.
• No force-new/immutable fields were identified on this resource in the live schema at authoring time. Verify against your pinned provider version before relying on that if the provider is upgraded past ~> 1.98 — some immutability constraints have historically been added to this provider after being previously unenforced.

• API token (confirmed against the resource's own live documentation): settings.read ("Read settings"), settings.write ("Write settings"). This corrects an earlier draft that used the classic Config API v1 permission names (ReadConfig/WriteConfig), which do not apply to this Settings-2.0-backed resource.
• OAuth (recommended path per this module suite's general Settings-2.0 guidance): settings:objects:read, settings:objects:write — not independently confirmed on this resource's own documentation page, which states only the API-token scopes above. Verify against your own environment/IAM policy before a production OAuth grant.
• This module does not touch IAM or Automation resources, so no account-idm-* or automation:* scopes are needed for this module specifically.

• An OAuth client (or legacy API token) provisioned with the scopes/permissions above.
• An existing terraform-dynatrace-alerting-profile instance (or a pre-existing alerting profile ID) to pass into var.profile — this module has nothing to attach to otherwise.
• A PagerDuty account (subdomain) and a PagerDuty service already provisioned on the PagerDuty side, plus a PagerDuty Events API integration key for that service if the integration is to actually deliver events. Provisioning the PagerDuty-side account/service/key is out of scope for this module and for the Dynatrace Terraform provider generally.

terraform-dynatrace-pagerduty-notification/
├── providers.tf # required_version + provider pin — no provider {} block
├── variables.tf # name, profile, account, service, api_key (sensitive), active (default false)
├── main.tf # dynatrace_pager_duty_notification.this — thin, total renderer
├── outputs.tf # id, name — api_key is intentionally never output
├── SCOPE.md # Lightweight cross-module contract
├── README.md # This file
└── examples/
 └── quick-start/
 └── main.tf

module "pagerduty_notification" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-platform-oncall"
  profile = module.alerting_profile.id # terraform-dynatrace-alerting-profile output
  account = "acme"
  service = "platform-oncall"
}

The caller configures the dynatrace provider (auth and dt_env_url) once, outside this module — see examples/quick-start/main.tf for a complete, directly-runnable snippet including provider configuration. This minimal call deliberately omits api_key and active; the resulting integration is created but inert (active = false) until reviewed.

Consumes

Emits

module "pagerduty_notification" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-minimal"
  profile = module.alerting_profile.id
  account = "acme"
  service = "default-oncall"
}

variable "pagerduty_events_api_key" {
  type      = string
  sensitive = true
}

module "pagerduty_notification_prod" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-prod-checkout-oncall"
  profile = module.alerting_profile_prod.id
  account = "acme"
  service = "checkout-oncall"
  api_key = var.pagerduty_events_api_key
  active  = true
}

module "pagerduty_notification_payments_team" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-payments-team-oncall"
  profile = module.alerting_profile_payments.id
  account = "acme"
  service = "payments-team-oncall"
}

module "pagerduty_notification_nonprod" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-nonprod-smoke-test"
  profile = module.alerting_profile_nonprod.id
  account = "acme-nonprod"
  service = "nonprod-smoke-test"
}

data "azurerm_key_vault_secret" "pagerduty_events_api_key" {
  name         = "pagerduty-events-api-key-checkout"
  key_vault_id = data.azurerm_key_vault.casey_secrets.id
}

module "pagerduty_notification_checkout" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-checkout-oncall"
  profile = module.alerting_profile_checkout.id
  account = "acme"
  service = "checkout-oncall"
  api_key = data.azurerm_key_vault_secret.pagerduty_events_api_key.value
  active  = true
}

module "pagerduty_notification_maintenance_window" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-checkout-oncall"
  profile = module.alerting_profile_checkout.id
  account = "acme"
  service = "checkout-oncall"
  api_key = var.pagerduty_events_api_key
  active  = false # flipped from true during a planned maintenance window
}

locals {
  pagerduty_services = {
    checkout = "checkout-oncall"
    payments = "payments-oncall"
    identity = "identity-oncall"
  }
}

module "pagerduty_notification_by_service" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  for_each = local.pagerduty_services

  name    = "pagerduty-${each.key}-oncall"
  profile = module.alerting_profile_platform.id
  account = "acme"
  service = each.value
}

module "pagerduty_notification_legacy_profile" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-legacy-profile-oncall"
  profile = "b1cb2828-1234-4c5d-9e0a-abcdef012345" # a profile ID that exists in the environment but is not Terraform-managed here
  account = "acme"
  service = "legacy-oncall"
}

variable "pagerduty_events_api_key" {
  type      = string
  sensitive = true
  # Supplied at plan/apply time from the caller's secrets manager — rotate the value there, then
  # re-plan. Terraform redacts this value from console output because the variable itself is
  # declared sensitive, and the underlying dynatrace_pager_duty_notification.api_key attribute is
  # separately provider-flagged sensitive.
}

module "pagerduty_notification_checkout" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-checkout-oncall"
  profile = module.alerting_profile_checkout.id
  account = "acme"
  service = "checkout-oncall"
  api_key = var.pagerduty_events_api_key
  active  = true
}

locals {
  team_oncall_services = {
    "payments-team" = "payments-oncall"
    "identity-team" = "identity-oncall"
    "platform-team" = "platform-oncall"
  }
}

module "pagerduty_notification_team" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  for_each = local.team_oncall_services

  name    = "pagerduty-${each.key}"
  profile = module.alerting_profile_platform.id
  account = "acme"
  service = each.value
}

output "pagerduty_integration_names_by_team" {
  value = { for k, m in module.pagerduty_notification_team : k => m.name }
}

module "pagerduty_notification_env" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-${var.environment}-checkout-oncall"
  profile = module.alerting_profile_env.id
  account = var.environment == "prod" ? "acme" : "acme-nonprod"
  service = "checkout-oncall"
  active  = var.environment == "prod"
}

module "pagerduty_notification_smoke_test" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-smoke-test"
  profile = module.alerting_profile_smoke_test.id
  account = "acme-nonprod"
  service = "smoke-test"
}

module "alerting_profile_platform_oncall" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-alerting-profile.git?ref=v1.0.0"

  name = "platform-oncall"

  rules = {
    availability-all-entities = {
      severity_level   = "AVAILABILITY"
      include_mode     = "INCLUDE_ANY"
      delay_in_minutes = 5
      tags             = ["team:platform"]
    }
  }
}

variable "pagerduty_events_api_key" {
  type      = string
  sensitive = true
}

module "pagerduty_notification_platform_oncall" {
  source = "git::https://github.com/microsoftexpert/terraform-dynatrace-pagerduty-notification.git?ref=v1.0.0"

  name    = "pagerduty-platform-oncall"
  profile = module.alerting_profile_platform_oncall.id # <- wired from the sibling module's output
  account = "acme"
  service = "platform-oncall"
  api_key = var.pagerduty_events_api_key
  active  = true
}

output "platform_oncall_alerting_profile_id" {
  value = module.alerting_profile_platform_oncall.id
}

output "platform_oncall_pagerduty_notification_id" {
  value = module.pagerduty_notification_platform_oncall.id
}

variable "name" {
  type = string
  # The name of the notification configuration. Required — no provider-side default.
}

variable "profile" {
  type = string
  # The ID of the associated Dynatrace alerting profile. Required. Pass the `id` output of a
  # terraform-dynatrace-alerting-profile instance — this module does not own, create, or manage
  # alerting profiles; it only references one by ID.
}

variable "account" {
  type = string
  # The name of the PagerDuty account (the PagerDuty subdomain, e.g. "acme" for acme.pagerduty.com).
  # Required — no provider-side default.
}

variable "service" {
  type = string
  # The name of the PagerDuty service this notification integration routes events to. Required — no
  # provider-side default. A PagerDuty-side identifier, not a cross-module reference.
}

variable "api_key" {
  type      = string
  default   = null
  sensitive = true
  # The PagerDuty Events API key. Optional per the live schema; sensitive = true. Never pass a
  # literal value — source it from your own secrets manager. Never output or re-exported by this
  # module (see outputs.tf).
}

variable "active" {
  type    = bool
  default = false
  # Whether this integration is enabled. Required at the resource level in the live schema (no
  # provider default); this module supplies its own secure-by-default module-level default of false.
}

api_key is never output — it is not present in outputs.tf at all, sensitive-marked or otherwise. legacy_id (present in the live provider schema as a computed interop attribute) is likewise not exposed by this module; see "Schema notes that bite" above.

• main.tf is a single, non-dynamic resource block — the live schema for dynatrace_pager_duty_notification has no nested block_types, so there is nothing for a dynamic block to render. Every variable maps 1:1 onto a resource argument.
• api_key = try(var.api_key, null) in main.tf is defensive rather than strictly necessary given var.api_key's own default = null — it guarantees the resource always receives an explicit null rather than an unset argument if the variable's default is ever changed, consistent with the house "try(x, null) on every optional nested field" convention even though this field is not nested.
• This module is environment-scoped (Settings 2.0, tied to a specific Dynatrace tenant), not account-scoped like the IAM/Account Management resource family — a single provider configuration targeting one environment is sufficient; there is no split-API-surface concern here the way there is for a composite mixing environment-scoped and IAM resources.
• There is no for_each-driven child in this module. Fan-out to multiple PagerDuty services sharing one alerting profile is a call-site concern (see Example 7), not something this module renders internally.
• Because profile is a plain string, Terraform's implicit dependency graph (parent-before-child) relies entirely on the caller passing module.alerting_profile.id rather than a literal string, when the profile is also managed in the same configuration — passing a literal ID for an independently-managed profile is legitimate (see Example 8) but forfeits Terraform's automatic ordering guarantee for that profile.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module at ?ref=v1.0.0 — never a branch. This library is plan-only: a human applies from CI after review. No cloud apply is ever performed by the authoring process itself.

terraform validate and terraform fmt -check are the offline proof gate for this module: they confirm the HCL parses, the type system accepts every combination of required/optional inputs shown in the Example Library, and formatting is house-standard. Both were run clean against this module (terraform init -backend=false && terraform validate && terraform fmt -check, zero errors) before this module was considered complete.

What offline validation does not cover, and what only a real plan against a live Dynatrace environment exercises:

• Whether the profile ID actually resolves to an existing alerting profile in the target environment.
• Whether the supplied account (PagerDuty subdomain) and service values correspond to a real, reachable PagerDuty account/service pair.
• Whether the OAuth client or API token configured on the provider actually holds settings:objects:read / settings:objects:write (or settings.read / settings.write) — an under-scoped credential fails at apply, not at validate.
• Whether a supplied api_key is a valid, active PagerDuty Events API key — Terraform has no way to verify PagerDuty-side credential validity offline.

$ terraform output

pagerduty_notification_id = "vu9U3hXY3q0AAAABACJk"
pagerduty_notification_name = "pagerduty-platform-oncall"

(Synthetic values for illustration — actual IDs are assigned by Dynatrace at apply time.)

• Provider resource reference: dynatrace_pager_duty_notification (dynatrace-oss/dynatrace ~> 1.98)
• Sibling module: terraform-dynatrace-alerting-profile — owns the profile this module references
• This module's SCOPE.md — cross-module contract, required scopes, and prerequisites

💙 "Infrastructure as Code should be standardized, consistent, and secure."