# Configure trial settings as code

> Import and review existing governance settings with Terraform or Pulumi.

Source: https://docs.atensecurity.com/docs/getting-started/trial-settings

Set `THOTH_TENANT_ID` to the tenant ID supplied during onboarding. This guide
is for administrators after the [first governed agent](https://docs.atensecurity.com/docs/getting-started/quickstart).

## Configure an existing tenant

This optional step configures the existing trial tenant through GovAPI; it
does not provision AWS infrastructure or create a trial. Use **one** provider
workflow for the tenant singleton, and coordinate with other administrators.
It needs the separate organization key with read/write permissions.

The examples retain blocking for high and critical risk. They do not set
compliance declarations, add integrations, or replace the trial demo policy.
Import the existing settings first, save the prior values privately, and
review the plan or preview before applying. Preserve your state: removing
this settings resource or running destroy does **not** restore prior shadow
policy values. To undo an update, explicitly apply the saved prior values.

**Terraform**

In a separate directory, save as `main.tf`:

```hcl title="main.tf"
terraform {
  required_version = ">= 1.5"
  required_providers {
    thoth = {
      source  = "atensecurity/thoth"
      version = "~> 0.1.16"
    }
  }
}

variable "tenant_id" { type = string }
variable "govapi_base_url" { type = string }
variable "org_api_key_file" { type = string }

provider "thoth" {
  tenant_id        = var.tenant_id
  api_base_url     = var.govapi_base_url
  org_api_key_file = var.org_api_key_file
}

resource "thoth_governance_settings" "trial" {
  shadow_high     = "block"
  shadow_critical = "block"
}
```

```bash title="Terminal"
# Use an absolute private file containing the organization read/write key.
unset THOTH_API_KEY
export TF_VAR_tenant_id="$THOTH_TENANT_ID"
export TF_VAR_govapi_base_url="<your-govapi-base-url>"
export TF_VAR_org_api_key_file="/absolute/private/path/trial-org-key"
terraform init
terraform import thoth_governance_settings.trial "$TF_VAR_tenant_id"
# Save prior settings privately before changing them; state may contain secrets.
terraform state show thoth_governance_settings.trial
terraform plan -out=trial.plan
terraform apply trial.plan
```

Commit `.terraform.lock.hcl` to pin the installed version. Keep state,
plans, credentials, and `.terraform/` out of source control. See the
[Terraform provider reference](https://docs.atensecurity.com/docs/terraform-provider) for other settings.

**Pulumi (Python)**

In a separate directory, create these files:

`Pulumi.yaml`:

```yaml title="Pulumi.yaml"
name: thoth-trial-settings
runtime: python
description: Manage high-risk blocking in an existing trial tenant
```

`requirements.txt`:

```text title="requirements.txt"
pulumi>=3.170,<4
pulumi-thoth==0.1.16
```

`__main__.py`:

```python title="__main__.py"
import pulumi
import pulumi_thoth as thoth

config = pulumi.Config()
provider = thoth.Provider(
    "thoth",
    tenant_id=config.require("tenantId"),
    api_base_url=config.require("govapiBaseUrl"),
    org_api_key_file=config.require("orgApiKeyFile"),
)

settings = thoth.governance.GovernanceSettings(
    "trial",
    shadow_high="block",
    shadow_critical="block",
    opts=pulumi.ResourceOptions(
        provider=provider,
        import_=config.require("tenantId"),
    ),
)
pulumi.export("tenant", settings.tenant_id)
```

```bash title="Terminal"
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
unset THOTH_API_KEY
pulumi stack init trial
pulumi config set tenantId "$THOTH_TENANT_ID"
pulumi config set govapiBaseUrl "<your-govapi-base-url>"
pulumi config set orgApiKeyFile "/absolute/private/path/trial-org-key"
pulumi preview
pulumi up
```

For the first import, match `shadow_high` and `shadow_critical` to the
existing values reported by preview if they differ, then import with
`pulumi up`. Save those prior values privately. Remove `import_` from the
program after import, set both values to `block`, and preview the update
before applying it. The provider preserves settings not supplied here.
See the [Pulumi provider reference](https://docs.atensecurity.com/docs/pulumi-provider) for configuration
and state handling.

Return to the SDK terminal and reload your execute key before running the
agent again. The provider key should stay in the configuration workflow.