Docs

Configuration

Every setting you have, and where it lives. This page covers the manager module's inputs, in your Terraform. Discovery, workloads and schedules are set in the dashboard: each has its own page.

5 min readManager 0.21.0

The manager module

Inputs of modules/manager in the release archive (Get started). Only env is required.

Input	What it does
`env`string · required	Environment name, 1 to 10 lowercase letters, digits or inner hyphens: resources are named `dmt-<env>-manager-*`, installed routers `dmtr-<env>`.
`organization_id`string · `null`	Your AWS organization (`o-…`): the manager assumes roles, and accepts router events, within it only. Null: the manager is outside any organization and reads its own account only. `discovery_mode` must then be `account`.
`discovery_mode`string · `"organization"`	The mode of the discovery perimeter's default configuration, the one an administrator has not saved yet. `organization` means the accounts of the organization. `account` means the manager's own account. It must be `account` without `organization_id`.
`admin_emails`list(string) · `[]`	First administrators, invited by email at apply.
`savings_baseline`string · `always`	What the estimated savings are counted against. `always`: the workloads would run 24/7. `business-hours`: only the time asleep on weekdays from 08:00 to 20:00 counts.
`savings_timezone`string · `UTC`	The time zone of the business-hours baseline, an IANA name such as `Europe/Paris`.
`history_days`number · `400`	How long each workload's state history is kept, from 7 days to 10 years. It holds the timeline of the workload view, and it is what the savings are computed from. A change applies to the history written afterwards.
`states_cache_minutes`number · `60`	How long the manager keeps each workload's figures for the bar of all workloads in the Workloads view, from 1 minute to a day. The figures are the time in each state over 7 days and the savings over 30 days. Each refresh reads every workload's history.
`mfa`string · `operators`	Two-step verification with an authenticator app, set up from the dashboard's Account page. `optional`: any user may turn it on. `operators`: administrators and operators must use it, and keep viewer rights until they do. `required`: everyone, asked at sign-in. Keep two administrators with an authenticator: another one resets a lost one.
`passkeys`bool · `true`	Sign-in with a passkey (a fingerprint, a face, a PIN or a security key), registered from the dashboard's Account page. It works in the `optional` and `operators` MFA modes. With `false`, or with `mfa = required`, the user pool stays password plus authenticator app. Changing the custom domain later makes the registered passkeys unusable: users register them again.
`alert_emails`list(string) · `[]`	Addresses of the health alerts: a router that stops reporting or reports a problem, an IP list that fails, the manager's own watchdog. Each address confirms the email AWS sends first. Other channels subscribe to the `alerts_topic_arn` output.
`ip_lists`list(object) · `[]`	IP reputation lists the manager downloads once for every router. Each has `name`, `url` (http(s) or `s3://`), `action` and `refresh_hours` (24). With `action` at `defer`, the default, a listed source wakes only through the waiting page's probe. With `ignore`, it never does. A version that lost more than half its entries is refused: change the URL to accept it. URLs are readable in your organization: no secret in them.
`domain`object · `null`	A custom domain: `dashboard` host, `auth` host under it, their `certificate_arn` in us-east-1, optionally the Route 53 `zone_id` where the records are created. Without: CloudFront's and Cognito's own hosts.
`ses_identity`string · `null`	A verified SES identity of this account and region through which Cognito sends the invitations. Without: Cognito sends them itself (about 50 a day).
`email_from`string · `null`	Sender of the invitations with `ses_identity`, for example `Dormeto <no-reply@example.com>`. It is required with a domain identity.
`deletion_protection`bool · `true`	Protects the users and the manager's table (installed routers, operations, audit) from a mistaken destroy. Set to `false` and apply before `terraform destroy`.
`log_retention_days`number · `30`	Retention of the manager's CloudWatch logs.
`discovery_role_name`string · `DmtDiscoveryRole`	The read-only role the manager assumes in each account. A path may precede the name.
`command_role_name`string · `DmtCommandRole`	The role the manager assumes to install routers and act on their rules. A path may precede the name.
`create_organization_roles`bool · `true`	Creates the roles of the manager's own account. `false` for a second environment in an account whose roles another environment creates.
`organization_role_envs`list(string) · `[]`	Other manager environments of this account that the roles created here also trust.
`install`object · `null`	Manager 0.12.0 and later: `{ bucket, project, log_group }`, set by `dormeto aws install`. Leave unset.

Outputs: dashboard_url, auth_domain (the sign-in host), user_pool_id, dashboard_client_id, api_endpoint. version gives the manager's and the router's it installs. alerts_topic_arn is the alert topic. ip_lists_catalog is the lists' catalog, for a router written in Terraform: its ip_lists_catalog.

Role names

The role names are Terraform settings on purpose, not dashboard settings. The manager's own permissions allow assuming exactly those roles. So no dashboard user can point it at another role. The access module or the AWS CLI script must use the same names (Organization access).

Discovery

The discovery perimeter, its filters and excludes, and its refresh are set in the dashboard: Discovery.

Workloads

What onboarding sets, what you can do afterwards and the fixed defaults: Workloads. The workload module has one input for EC2 hibernation, hibernate (bool · null). null inherits the router's value, then the manager's (off when the workload has fallback instance types). true or false sets it on the workload (Hibernation). Router 0.32.0 and later.

It also has waiting_page (object · null), the page visitors see while the workload wakes:

mode: template or custom.
For a template, icon: auto, none or a data:image/…;base64,… address of at most 64 KiB. For example, "data:image/png;base64,${filebase64("logo.png")}".
For a template, title (80 characters, one line) and description (500 characters).
For a custom page, html: at most 256 KiB. For example, file("waiting.html").

null writes nothing, and removing it removes the page it created. A workload with waiting_page refuses changes from the manager. Router 0.35.0 and later (Waiting page).

Schedules

Weekly awake and nap windows, exception dates and the maximum nap, with the Schedules calendar: Schedules.

From router 0.36.0, joinMinutes is the largest gap that joins two windows of one kind, 15 by default. Set it on a schedule, a router, or as workloads.joinMinutes in the manager's settings.json: Joined windows.

workloads.endedWindowDays is how long a window stays in its schedule after its last occurrence, 365 days by default, 0 to keep them: Ended windows.