continueops_risk (Resource)

An entry in the risk register: what could happen, how likely and how bad, before (likelihood x impact) and after (residual_*) mitigation, and the BIAs and services it threatens.

Putting a risk in assessed, accepted or treating, or changing its scores while it is in one of those, records a new assessment: the platform stamps assessed_at and appends an immutable, fingerprinted snapshot to the risk's history. A Terraform apply that changes those values therefore adds to the audit trail; that is intended.

Destroy is a soft delete, as in the UI: the assessment history is kept.

Risks are only reachable with an API key minted in its owner's primary tenant.

Example Usage

resource "continueops_risk" "blackout" {
  title           = "Regional blackout exceeding 8 hours"
  category        = "power"
  likelihood      = 2
  impact          = 5
  residual_impact = 3
  mitigation      = "Generator with 72h fuel; failover to the secondary region"
  status          = "assessed"
  entity_id       = continueops_org_entity.uk.id
  review_due_on   = "2027-03-31"

  links = [
    { object_type = "service", object_id = continueops_service.faster_payments.id },
  ]
}

Schema

Required

title (String) What could happen, 1-300 characters, no surrounding whitespace.

Optional

category (String) Category slug. Built in: natural_event, flooding, storm, power, cyber, supplier, people, site, technology, pandemic, regulatory, other; tenants add their own through Lookups (kind risk_category). Lower-case snake_case, up to 64 characters. Default other.
description (String) Detail, up to 8000 characters.
entity_id (String) The continueops_org_entity that owns the risk (lower-case UUID).
impact (Number) Inherent impact, 1 (very low) to 5 (very high). Default 3.
likelihood (Number) Inherent likelihood, 1 (very low) to 5 (very high). Default 3.
links (Attributes Set) What the risk threatens, at most 200, e.g. { object_type = "service", object_id = continueops_service.x.id }. This resource owns the risk's links: links added in the UI are removed on the next apply. (see below for nested schema)
mitigation (String) How the risk is mitigated, up to 8000 characters.
owner_user_id (String) The risk owner (lower-case UUID). The user must be a member of the tenant; data.continueops_tenant.<name>.user_id is the API key's own user.
residual_impact (Number) Impact after mitigation, 1 (very low) to 5 (very high). Unset means the same as the inherent value.
residual_likelihood (Number) Likelihood after mitigation, 1 (very low) to 5 (very high). Unset means the same as the inherent value.
review_due_on (String) When the assessment must be reviewed, YYYY-MM-DD. Past it, the risk counts as overdue.
status (String) identified, pending_approval, accepted, treating or closed. Default identified.

An assessment needs a second person: set pending_approval to submit it, and an approver signs it off in ContinueOps, which moves the risk to assessed. Terraform never approves (the platform refuses an assessment approved by its submitter), so assessed cannot be configured. Once approved, status stays pending_approval in state, meaning "submitted", and effective_status reads assessed; later applies keep the approval. If the approver rejects it, the next plan resubmits.

timeouts (Attributes) (see below for nested schema)

Read-Only

assessed_at (String) When the risk was last assessed (RFC 3339, UTC); null if never. Set by the platform.
created_at (String) When the risk was created (RFC 3339, UTC).
effective_status (String) The status the platform holds now, including assessed once an approver has signed the assessment off.
id (String) Risk id (UUID).
inherent_score (Number) likelihood x impact (1-25).
reference (String) Register reference assigned by the platform, e.g. RSK-0007. Never changes.
residual_score (Number) Residual likelihood x residual impact, each falling back to its inherent value (1-25).
updated_at (String) When the risk last changed (RFC 3339, UTC).

Nested Schema for `links`

Required:

object_id (String) Id of the linked object (lower-case UUID). It must be live in this tenant.
object_type (String) service (a continueops_service) or bia (a business impact analysis). Links to BCO components are not offered: the platform cannot store them yet.

Nested Schema for `timeouts`

Optional:

create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
read (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

import {
  to = continueops_risk.example
  id = "00000000-0000-4000-8000-000000000000"
}

The terraform import command can be used, for example:

# Import by id (UUID), shown in the ContinueOps UI and returned by the API.
terraform import continueops_risk.example 00000000-0000-4000-8000-000000000000

continueops