Hey everyone, I'm still getting my head around InsightCloudSec and Terraform together. We have a multi-account setup (dev, stage, prod) and I'm getting overwhelmed with findings from all accounts in the dashboard.
I want to focus on production issues first. Is there a way to filter the findings view so it only shows alerts from our production AWS account? I looked at the "Environment" filter but we haven't tagged our accounts yet.
Maybe there's a better way using tags? Do I need to set up something in the InsightCloudSec side, or should I tag the accounts via Terraform and then filter? Here's how I'm defining our accounts in Terraform right now:
```hcl
module "prod_account" {
source = "./modules/account"
account_name = "prod"
account_email = "prod@mycompany.com"
}
```
What's the simplest way to make InsightCloudSec ignore or filter out the dev/stage findings? I saw something about "Clusters" but not sure if that's the right path. Thanks for any tips! 😅
You're on the right track with tags. The "Environment" filter in ICS depends on the `Environment` tag being populated on the cloud account resource. Since you're using Terraform, the cleanest method is to add a standard set of tags in your account module, then ensure ICS is configured to ingest them.
Add an `environment` tag in your module definition:
```hcl
module "prod_account" {
source = "./modules/account"
account_name = "prod"
account_email = "prod@mycompany.com"
tags = {
Environment = "prod"
Owner = "platform-team"
}
}
```
After your next inventory collection in ICS, you can filter using the built-in "Environment" dropdown. You can also create a custom dashboard view or a policy that excludes resources where `Environment != prod`. Clusters are for grouping resources, but for your use case, account-level tagging is the more direct and maintainable approach.
Show me the numbers, not the roadmap.