---
page_title: "ona_security_policy Resource - ona"
subcategory: "Security and Secrets"
description: |-
  Ona security policy for environment runtime controls. Attach the resulting policy through organization policy settings to make it the default for new environments.
---

# ona_security_policy (Resource)

Ona security policy for environment runtime controls. Attach the resulting policy through organization policy settings to make it the default for new environments.

For product context, see [Guardrails](https://ona.com/docs/ona/guardrails/overview), [Veto](https://ona.com/docs/ona/guardrails/veto), and [Organization policies](https://ona.com/docs/ona/organizations/policies/overview).

## Example Usage

```terraform
resource "ona_security_policy" "baseline" {
  organization_id = "00000000-0000-0000-0000-000000000000"
  name            = "baseline"

  spec {
    ports {
      max_admission_level = "organization"
    }

    executables {
      default_effect = "allow"

      rule {
        path   = "/usr/bin/nc"
        effect = "audit"
      }
    }
  }
}

resource "ona_security_policy" "ports_only" {
  organization_id = "00000000-0000-0000-0000-000000000000"
  name            = "port-controls"

  spec {
    ports {
      max_admission_level = "creator_only"
    }
  }
}

resource "ona_security_policy" "executables_only" {
  organization_id = "00000000-0000-0000-0000-000000000000"
  name            = "executable-controls"

  spec {
    executables {
      default_effect = "allow"

      rule {
        path   = "/usr/bin/nc"
        effect = "audit"
      }
    }
  }
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Security policy name shown in Ona. Must be between 1 and 80 characters.
- `organization_id` (String) Organization ID that owns the security policy. Changing this value replaces the policy.

### Optional

- `spec` (Block, Optional) Runtime security controls enforced for environments using this policy. Configure one or more policy sections depending on what the policy should control. (see [below for nested schema](#nestedblock--spec))

### Read-Only

- `created_at` (String) Time when the security policy was created.
- `id` (String) Security policy ID.
- `updated_at` (String) Time when the security policy was last updated.

<a id="nestedblock--spec"></a>
### Nested Schema for `spec`

Optional:

- `executables` (Block, Optional) Executable access policy. Rules match executable paths inside the environment. (see [below for nested schema](#nestedblock--spec--executables))
- `ports` (Block, Optional) Port admission policy for user-opened ports. (see [below for nested schema](#nestedblock--spec--ports))

<a id="nestedblock--spec--executables"></a>
### Nested Schema for `spec.executables`

Required:

- `default_effect` (String) Default executable access effect. Supported values are `allow`, `block`, and `audit`.

Optional:

- `rule` (Block List) Executable path rule. (see [below for nested schema](#nestedblock--spec--executables--rule))

<a id="nestedblock--spec--executables--rule"></a>
### Nested Schema for `spec.executables.rule`

Required:

- `effect` (String) Effect for this executable path. Supported values are `allow`, `block`, and `audit`.
- `path` (String) Executable path inside the environment.



<a id="nestedblock--spec--ports"></a>
### Nested Schema for `spec.ports`

Optional:

- `max_admission_level` (String) Maximum admission level for user-opened ports. Supported values are `everyone`, `organization`, and `creator_only`. Omit the ports block to leave port admission unrestricted by this security policy.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env bash

terraform import ona_security_policy.ports_only 00000000-0000-0000-0000-000000000000
```