driftctl offers two ways to filter resources:
- Filter rules
.driftignore is a simple way to ignore resources, you put resources in a
.driftignore file like a
Filter rules allow you to build complex expression to include and exclude a set of resources in your workflow. Powered by expression language JMESPath you could build a complex include and exclude expression.
If you need only to exclude a set of resources you should use .driftignore, if you need something more advanced, check filter rules.
Create the .driftignore file where you launch driftctl (usually the root of your IaC repo).
Each line must be of kind
resource_type.resource_id, resource_id could be a wildcard to exclude all resources of a given type.
resource_type.resource_id.path.to.FieldName, resource_id can be wildcard to ignore a drift on given field for a given type, path could also contain wildcards.
Fields are not case-sensitive.
If your resource id or the path of a field contains dot or backslash you can escape them with backslashes:
Filter rules could be passed to
scan cmd with
You could also use the environment variable
Filter rules syntax in use is actually JMESPath.
Filter are applied on a normalized struct which contains the following fields:
- Type: Type of the resource, e.g.
- Id: Id of the resource, e.g.
- Attr: Contains every resource attributes (check
pkg/resource/aws/aws_s3_bucket.gofor a full list of supported attributes of a bucket)