terraform-provider-stackgen

sg_governance (Resource)

Manages a StackGen governance configuration and its latest version.

Create provisions version 1. Updating rules or description creates a new version (prior versions remain until deleted). Assign versions to workspaces with sg_governance_assignment using version_id.

Example Usage

resource "sg_governance" "prod" {
  name        = "default-prod-governance"
  description = "Baseline production governance"

  allowed_target_compute = ["aws-ecs", "aws-lambda"]
}

resource "sg_project" "payments" {
  name        = "team-payments"
  description = "Payments workspace"
}

resource "sg_governance_assignment" "payments" {
  governance_version_id = sg_governance.prod.version_id
  workspace_id          = sg_project.payments.id
}

Import

Tenant-owned governance:

terraform import sg_governance.example '123e4567-e89b-12d3-a456-426614174000'

Non-tenant ownership:

terraform import sg_governance.example 'Organization/<owner-uuid>/<governance-uuid>'

Schema

Required

• description (String) Human-readable description. Updating creates a new governance version.
• name (String) Governance configuration name. Unique per owner. Changing forces a new resource.

Optional

• allowed_target_compute (List of String) Allowed target compute values for appstacks (for example aws-ecs, aws-lambda, k8s). Empty means any target compute is allowed.
• custom_resource_restriction_policies (List of String) Resource-restriction policy UUIDs that limit available IaC resources.
• custom_resource_security_policies (List of String) Custom resource security policy UUIDs required when matching resources are used.
• owner_id (String) UUID of the owner. For Tenant ownership use the all-zero UUID (default). For Organization ownership use the workspace UUID. Changing forces a new resource.
• owner_type (String) Owner type for the governance config. Use Tenant for tenant-wide configs (default) or Organization for workspace-scoped configs. Changing forces a new resource.
• required_security_policies (List of String) Security policy UUIDs that must be set (and are the only ones allowed) on appstacks.
• required_terraform_block (Attributes) Optional terraform block enforced on assigned topologies. (see below for nested schema)

Read-Only

• id (String) Governance configuration UUID (server-assigned).
• version (Number) Integer version number of the latest governance version.
• version_id (String) UUID of the latest governance version managed by this resource. Wire this into sg_governance_assignment.

Nested Schema for required_terraform_block

Required:

• file_contents (String) HCL or JSON for a single top-level terraform block enforced on assigned topologies.

Optional:

• file_format (String) Format of file_contents. Allowed values: hcl, json. Defaults to hcl when omitted.