From bb9de195906766425fd8f20b45059db258d340d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adis=20Halilovi=C4=87?= Date: Wed, 10 Jun 2026 12:10:31 +0200 Subject: [PATCH 1/2] Update README.md. --- README.md | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 401a7b6..a10bfd3 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ Perform `terraform login` to ensure that your local Terraform can interact with ### Export the resource definitions and Terraform state -- Choose the transformer and locate the example of `terraform.tfvars.example` and rename it to `terraform.tfvars`. +- Choose the transformer and copy `terraform.tfvars.example` to `terraform.tfvars`. - Edit terraform.tfvars with appropriate variables. - Run the following commands: @@ -37,11 +37,11 @@ terraform apply -auto-approve -var-file=terraform.tfvars A new `export` folder should have been created. The `sg-payload.json` file contains the definition for each workflow that will be created for each Terraform Workspace, and the `states` folder contains the files for the Terraform state for each of your workspaces, if the state export was enabled. -After completing the export , edit the `sg-payload.json` file to provide tune each workflow configuration with the following: +After completing the export, edit the `sg-payload.json` file to tune each workflow configuration with the following: ### Use the example_payload.jsonc file as a reference and edit the schema of the `sg-payload.json` -- `DeploymentPlatformConfig` - This is used to authenticate against a cloud provider using a StackGuardian Integration. Create the relevant integration in StackGuardian platform and update `DeploymentPlatformConfig.kind` from the following "AZURE_STATIC", "AWS_STATIC","GCP_STATIC", "AWS_RBAC". Update `DeploymentPlatformConfig.config.integrationId` with "/integrations/INTEGRATION_NAME" and `DeploymentPlatformConfig.config.profileName` with the name of the integration used upon creation. +- `DeploymentPlatformConfig` - This is used to authenticate against a cloud provider using a StackGuardian Integration. Create the relevant integration in StackGuardian platform and update `DeploymentPlatformConfig.kind` to one of the following "AZURE_STATIC", "AWS_STATIC","GCP_STATIC", "AWS_RBAC". Update `DeploymentPlatformConfig.config.integrationId` with "/integrations/INTEGRATION_NAME" and `DeploymentPlatformConfig.config.profileName` with the name of the integration used upon creation. ``` DeploymentPlatformConfig: [ @@ -55,7 +55,7 @@ After completing the export , edit the `sg-payload.json` file to provide tune ea ] ``` -- `VCSConfig` - Provide full path to the `repo` like as well the relevant `sourceConfigDestKind` from the following "GITHUB_COM", "BITBUCKET_ORG", "GITLAB_COM", "AZURE_DEVOPS" +- `VCSConfig` - Provide the full path to the `repo`, as well as the relevant `sourceConfigDestKind` from the following "GITHUB_COM", "BITBUCKET_ORG", "GITLAB_COM", "AZURE_DEVOPS" - `config.auth` - `config.isPrivate` - `ResourceName` - name of your StackGuardian Workflow @@ -80,13 +80,24 @@ After completing the export , edit the `sg-payload.json` file to provide tune ea - `UserSchedules` - Scheduled workflow run configuration for the workflow in the StackGuardian platform - `MiniSteps` - Ministeps for the workflow to direct the process if the workflow returns an error/success/approval required and workflow chaining +### Convert HCL variables to JSON + +HCL variables from Terraform Cloud appear as strings in `sg-payload.json` and need to be converted to JSON before importing. + +Run the script from the repo root, passing the exported payload. It rewrites the file in place — converting the HCL-string variable values under `VCSConfig.iacInputData.data` into JSON — so none of the following steps need any change. The script downloads `jq` and `hcl2json` at runtime. + +```shell +./convert_hcl_to_json.sh export/sg-payload.json +``` + ### Bulk import workflows to StackGuardian Platform - Fetch [sg-cli](https://github.com/StackGuardian/sg-cli.git) and set it up locally (documentation present in repo) - Run the following commands and pass the `sg-payload.json` as payload (represented below) +- `--workflow-group` is required even though `wfgrpName` is set in the payload. Pass the workflow group ID (e.g. `prj-ThpsFFz59kqFaVr4`). - Get your SG API Key here: - Login to Stackguardian. - - Go to profile at the bottom left. Click on the eamil or the username. + - Go to profile at the bottom left. Click on the email or the username. - Click API key and click on view. ```shell @@ -95,20 +106,11 @@ cd ../../export export SG_API_TOKEN= wget -q "$(wget -qO- "https://api.github.com/repos/stackguardian/sg-cli/releases/latest" | jq -r '.tarball_url')" -O sg-cli.tar.gz && tar -xf sg-cli.tar.gz && rm -f sg-cli.tar.gz && /bin/cp -rf StackGuardian-sg-cli*/shell/sg-cli . && rm -rfd StackGuardian-sg-cli* -./sg-cli workflow create --bulk --org "" -- sg-payload.json +./sg-cli workflow create --bulk --workflow-group "" --org "" -- sg-payload.json ``` if you want to update a workflow with different details, please re-run the sg-cli command with the modified sg-payload.json and your workflow will be updated with the new details, as long as the ResourceName (Workflow name) remains the same. ```shell -./sg-cli workflow create --bulk --org "" -- sg-payload.json -``` - -## Convert hcl variables to json - -HCL variables in terraform cloud appear as strings in sg-payload.json, which needs to be converted to json.
-It will change the file input file in place so that none of the other steps need any change. - -```shell -./convert_hcl_to_json.sh +./sg-cli workflow create --bulk --workflow-group "" --org "" -- sg-payload.json ``` From 3724af321126a3c3ead3d607df56798f14ac28ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adis=20Halilovi=C4=87?= Date: Fri, 19 Jun 2026 15:54:30 +0200 Subject: [PATCH 2/2] fix: Update terraform version migration. --- transformer/terraform-cloud/example_payload.jsonc | 2 +- transformer/terraform-cloud/locals.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/transformer/terraform-cloud/example_payload.jsonc b/transformer/terraform-cloud/example_payload.jsonc index 503c727..d7034a7 100644 --- a/transformer/terraform-cloud/example_payload.jsonc +++ b/transformer/terraform-cloud/example_payload.jsonc @@ -33,7 +33,7 @@ "Tags": [], // workflow tags "TerraformConfig": { "managedTerraformState": true, // managed state from StackGuardian - "terraformVersion": "1.1.6" // version of terraform + "terraformVersion": "TERRAFORM-1.1.6" // version of terraform }, "UserSchedules": [], "VCSConfig": { diff --git a/transformer/terraform-cloud/locals.tf b/transformer/terraform-cloud/locals.tf index 7c9ba1e..356730c 100644 --- a/transformer/terraform-cloud/locals.tf +++ b/transformer/terraform-cloud/locals.tf @@ -60,7 +60,7 @@ locals { TerraformConfig = { "managedTerraformState" : true, - "terraformVersion" : data.tfe_workspace.data[i].terraform_version, + "terraformVersion" : "TERRAFORM-${data.tfe_workspace.data[i].terraform_version}", "approvalPreApply" : !data.tfe_workspace.data[i].auto_apply }