Critical Resources
Overview
Critical Resources in Facets are designed to help protect sensitive infrastructure components by restricting who can make impactful changes. When a resource is marked as critical, specific actions—such as deleting the resource, changing its status, or editing sensitive fields—are limited to users with explicit permissions.
This feature is essential for high-stakes infrastructure components such as production databases, Kubernetes node pools, or persistent storage, where unintended changes can lead to downtime or data loss.
What Is a Critical Resource?
A resource is considered critical if:
- The module YAML includes critical: true.
- Certain fields within the module are marked as critical using x-ui-critical
Only users with the write_critical_resources permission can:
- Delete the resource
- Change its status (enable/disable)
- Edit fields marked as x-ui-critical
Users without this permission will see these actions as disabled or read-only.
Why Mark Resources as Critical?
In complex environments, even a small mistake—like changing a field or disabling a live service—can lead to unexpected downtime or data loss. While tools like prevent_destroy in Terraform offer some protection, they don’t help in cases where a resource is deleted or disabled from the blueprint entirely.
By marking a resource as critical, Facets provides a deliberate control mechanism that:
- Prevents accidental deletion or disablement
- Restricts changes to sensitive fields
- Establishes clear boundaries based on role-based access control (RBAC)
- Ensures traceability through audit logs
How It Works
For Critical Resources
- Cannot be deleted or disabled by users without the required permission
- Fields marked with x-ui-critical are read-only unless the user has permission
- All actions are logged with full context (who, what, when)
For Non-Critical Resources
- Behave as usual with no restrictions on status changes or field edits
- Accessible and editable by any user with general permissions
Use Cases
- Prevent accidental deletion of production databases
- Protect Kubernetes node pools from scale-down or misconfiguration
- Ensure only authorized personnel can change resource limits, persistent disk size, or compute allocations
How to Use Critical Resources
Permissions and Auditability
Permission Required: Only users with the write_critical_resources permission can make restricted changes to critical resources.
Audit Logs: Every critical action (delete, disable, modify critical fields) is logged with timestamp, user ID, and resource ID
Ensures traceability and compliance across your infrastructure operations
Summary
Critical Resources in Facets offer a robust safeguard for infrastructure components that require careful handling. By embedding this control directly into the platform, teams gain confidence that production-grade systems are protected from accidental or unauthorised modifications. The result: safer operations, cleaner access controls, and greater peace of mind across your engineering org.
Updated 4 days ago