Configure trial settings as code

Set THOTH_TENANT_ID to the tenant ID supplied during onboarding. This guide is for administrators after the first governed agent.

Configure an existing tenant

This optional step configures the existing trial tenant through GovAPI; it does not provision AWS infrastructure or create a trial. Use one provider workflow for the tenant singleton, and coordinate with other administrators. It needs the separate organization key with read/write permissions.

The examples retain blocking for high and critical risk. They do not set compliance declarations, add integrations, or replace the trial demo policy. Import the existing settings first, save the prior values privately, and review the plan or preview before applying. Preserve your state: removing this settings resource or running destroy does not restore prior shadow policy values. To undo an update, explicitly apply the saved prior values.

In a separate directory, save as main.tf:

main.tf

terraform {
  required_version = ">= 1.5"
  required_providers {
    thoth = {
      source  = "atensecurity/thoth"
      version = "~> 0.1.16"
    }
  }
}
 
variable "tenant_id" { type = string }
variable "govapi_base_url" { type = string }
variable "org_api_key_file" { type = string }
 
provider "thoth" {
  tenant_id        = var.tenant_id
  api_base_url     = var.govapi_base_url
  org_api_key_file = var.org_api_key_file
}
 
resource "thoth_governance_settings" "trial" {
  shadow_high     = "block"
  shadow_critical = "block"
}

Terminal

# Use an absolute private file containing the organization read/write key.
unset THOTH_API_KEY
export TF_VAR_tenant_id="$THOTH_TENANT_ID"
export TF_VAR_govapi_base_url="<your-govapi-base-url>"
export TF_VAR_org_api_key_file="/absolute/private/path/trial-org-key"
terraform init
terraform import thoth_governance_settings.trial "$TF_VAR_tenant_id"
# Save prior settings privately before changing them; state may contain secrets.
terraform state show thoth_governance_settings.trial
terraform plan -out=trial.plan
terraform apply trial.plan

Commit .terraform.lock.hcl to pin the installed version. Keep state, plans, credentials, and .terraform/ out of source control. See the Terraform provider reference for other settings.

Return to the SDK terminal and reload your execute key before running the agent again. The provider key should stay in the configuration workflow.

Configure trial settings as code

Configure an existing tenant

On this page