### Install Azure CLI with Extensions

Source: https://docs.stackguardian.io/docs/develop/library/custom-runtime-image

Installs the Azure CLI and necessary build dependencies for a custom Docker image.

```dockerfile
FROM <BASE_IMAGE>

USER root

RUN apk add --no-cache \
  py3-pip \
  gcc \
  musl-dev \
  python3-dev \
  libffi-dev

RUN pip install --no-cache-dir azure-cli

USER stackguardian
```

--------------------------------

### Scaling In Response Example

Source: https://docs.stackguardian.io/docs/organisation_settings/sso/scaling_runner_groups

Example JSON response showing idle runners, indicating a potential candidate for scaling in.

```json
{
  "ContainerInstances": [
    {
      "containerInstanceArn": "exampleArn",
      "status": "ACTIVE",
      "runningTasksCount": 0,
      "pendingTasksCount": 0
    }
  ]
}
```

--------------------------------

### Install StackGuardian Plugin

Source: https://docs.stackguardian.io/docs/backstage-plugin

Run this command at the root of your Backstage project to add the plugin dependency.

```bash
yarn --cwd packages/app add @stackguardian/backstage-plugin-sg-library
```

--------------------------------

### Install AWS CLI and 1Password CLI

Source: https://docs.stackguardian.io/docs/develop/library/custom-runtime-image

Installs the AWS CLI and 1Password CLI into a custom Docker image.

```dockerfile
FROM <BASE_IMAGE>

USER root

RUN apk add --no-cache aws-cli

RUN wget -q -O /tmp/op.zip \
  https://cache.agilebits.com/dist/1P/op2/pkg/v2.24.0/op_linux_amd64_v2.24.0.zip && \
  unzip /tmp/op.zip -d /usr/local/bin/ && \
  rm /tmp/op.zip && \
  chmod +x /usr/local/bin/op

USER stackguardian
```

--------------------------------

### Scaling Out Response Example

Source: https://docs.stackguardian.io/docs/organisation_settings/sso/scaling_runner_groups

Example JSON response showing high pending workflow counts, indicating a need to scale out.

```json
{
  "ContainerInstances": [
    {
      "containerInstanceArn": "exampleArn1",
      "status": "ACTIVE",
      "runningTasksCount": 1,
      "pendingTasksCount": 2
    },
    {
      "containerInstanceArn": "exampleArn2",
      "status": "ACTIVE",
      "runningTasksCount": 0,
      "pendingTasksCount": 3
    }
  ],
  "QueuedWorkflowsCount": 0,
  "PendingWorkflowsCount": 5,
  "RunningWorkflowsCount": 1
}
```

--------------------------------

### Build and verify custom runtime image

Source: https://docs.stackguardian.io/docs/develop/library/custom-runtime-image

Commands to build the image and verify that installed tools and the application are functioning correctly.

```bash
# Build your custom image
docker build -t my-custom-runtime:latest .

# Verify your tools are available
docker run --rm my-custom-runtime:latest aws --version
docker run --rm my-custom-runtime:latest pip list

# Verify the application still starts
docker run --rm my-custom-runtime:latest
```

--------------------------------

### Webhook Payload: User Sign-In

Source: https://docs.stackguardian.io/docs/organisation_settings/audit_logs

Example payload for an SG_SIGN_IN event.

```json
{
  "timestamp": 1757410496427,
  "message": {
    "id": "b831d3a7-e450-4acc-b524-78c8c17768a2",
    "date_created": "2025-09-09T09:34:56",
    "action": "SG_SIGN_IN",
    "actor": {
      "type": "user",
      "user": {
        "principalEmail": "user@stackguardian.io"
      }
    },
    "effect": "Deny",
    "sourceIp": "2106:9140:11:e7e:8c35:afe9:d781:aefb",
    "timestamp": 1757410496427,
    "user_name": "0067e754-6701-4072-9530-da736f5b1fde",
    "user_pool_id": "region",
    "company": null,
    "new_device_used": false
  }
}
```

--------------------------------

### Define a custom cron schedule

Source: https://docs.stackguardian.io/docs/deploy/workflows/workflow_components/scheduled_workflow

Example configuration for a daily execution schedule using cron fields.

```text
Minutes: 0
Hours: 11
Day of Month: *
Month: *
Day of Week: ?
Year: *
```

--------------------------------

### Install Custom Python Libraries

Source: https://docs.stackguardian.io/docs/develop/library/custom-runtime-image

Installs specific Python packages using pip within a custom Docker image.

```dockerfile
FROM <BASE_IMAGE>

USER root

RUN pip install --no-cache-dir \
  checkov \
  pyyaml

USER stackguardian
```

--------------------------------

### Accessing tfplan.json file path

Source: https://docs.stackguardian.io/docs/deploy/workflows/workflow_components/run

Example path for accessing the generated Terraform plan file within the workflow workspace.

```text
/mnt/sg_workspace/user/template-tf-aws-s3-demo-website/tfplan.json
```

--------------------------------

### Remote Plan Execution Output

Source: https://docs.stackguardian.io/docs/deploy/workflows/cli-driven-workflow

Example of the streaming logs and status output when running a remote plan via the CLI.

```text
Running plan in StackGuardian. Output will stream here. Pressing Ctrl-C
will stop streaming the logs, but will not stop the plan running remotely.

Preparing the remote plan...

To view this run in a browser, visit:
https://api.app.stackguardian.io/app/acme-corp/production-infra/runs/orgs:acme-corp:wfgrps:production-infra:networking:wfs:deploy-vpc:wfruns:a1b2c3d4e5f6

Waiting for the plan to start...

Running on private runner group
Runner Group: production-runners

Organization: "/orgs/acme-corp"
Workflow Run: "/wfgrps/production-infra/networking/wfs/deploy-vpc/wfruns/a1b2c3d4e5f6"
Using Deployment Platform Cloud: AWS
Using Cloud Connector: aws-connector

[...]

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + message_lengths = [
      + 13,
    ]
```

--------------------------------

### Extend the StackGuardian base image

Source: https://docs.stackguardian.io/docs/develop/library/custom-runtime-image

Use this Dockerfile structure to install additional system and Python dependencies while maintaining the required user permissions and configuration.

```dockerfile
FROM <BASE_IMAGE>

# Switch to root to install packages
USER root

# Install system packages
RUN apk add --no-cache \
  aws-cli \
  azure-cli \
  jq \
  bash

# Install Python packages
RUN pip install --no-cache-dir \
  boto3 \
  requests

# Switch back to the application user
USER stackguardian
```

--------------------------------

### Define EC2 Instance via JSON Input

Source: https://docs.stackguardian.io/docs/develop/library/iac_stack_templates

Example JSON configuration for defining an EC2 instance within a workflow template.

```json
{
  "create": true,
  "name": "production-instance",
  "instance_type": "t2.micro",
  "ami": "ami-0110d1b5b1cdd8780",
  "key_name": "production-key",
  "vpc_security_group_ids": ["sg-12345678"],
  "subnet_id": "subnet-12345678"
}
```

--------------------------------

### AWS CodeCommit Repository URL Examples

Source: https://docs.stackguardian.io/docs/connectors/vcs/awscodecommit

Use these URL formats when configuring the Git Repository source in StackGuardian, replacing the placeholders with your specific SSH key ID and repository details.

```text
ssh://APKA4V36KLB7H52IMNPE@git-codecommit.eu-central-1.amazonaws.com/v1/repos/aws-vpc
```

```text
ssh://APKA4V36KLB7H52IMNPE@git-codecommit.us-east-2.amazonaws.com/v1/repos/aws-vpc
```

--------------------------------

### Initialize Terraform

Source: https://docs.stackguardian.io/docs/deploy/workflows/cli-driven-workflow

Command to initialize the Terraform working directory after configuring the cloud block.

```bash
$ terraform init

Initializing HCP Terraform...

Initializing provider plugins...
- Reusing previous version of hashicorp/random from the dependency lock file
- Using previously-installed hashicorp/random v3.0.1

HCP Terraform has been successfully initialized!

You may now begin working with HCP Terraform. Try running "terraform plan"
to see any changes that are required for your infrastructure.

If you ever set or change modules or Terraform Settings,
run "terraform init" again to reinitialize your working directory.
```

--------------------------------

### Webhook Payload: Deny Action

Source: https://docs.stackguardian.io/docs/organisation_settings/audit_logs

Example payload for a denied PATCH request.

```json
{
  "timestamp": 1757411994648,
  "message": {
    "id": "b831d3a7-e450-4acc-b524-78c8c17768a3",
    "date_created": "2025-09-09T09:59:54",
    "action": "PATCH/api/v1/orgs/demo-org/wfgrps/policy-resolution-test/wfs/failing-aws-s3-demo-website-5swa/",
    "actor": {
      "type": "user",
      "user": {
        "principalEmail": "user@stackguardian.io"
      }
    },
    "effect": "DENY",
    "sourceIp": "158.1140.117.0",
    "timestamp": 1757411994
  }
}
```

--------------------------------

### Webhook Payload: Delete Action

Source: https://docs.stackguardian.io/docs/organisation_settings/audit_logs

Example payload for a successful DELETE request.

```json
{
  "timestamp": 1757412835493,
  "message": {
    "id": "b831d3a7-e450-4acc-b524-78c8c17768a4",
    "date_created": "2025-09-09T10:13:55",
    "action": "DELETE/api/v1/orgs/demo-org/wfgrps/workflow-delete-test/wfs/terraform-aws-vpc-stripped-new-cot6/",
    "actor": {
      "type": "user",
      "user": {
        "principalEmail": "user@stackguardian.io"
      }
    },
    "effect": "Allow",
    "sourceIp": "60.243.160.178",
    "timestamp": 1757412835,
    "request_body": {},
    "request_method": "DELETE",
    "query_params": {},
    "response": "Workflow terraform-aws-vpc-stripped-new-cot6 deleted"
  }
}
```

--------------------------------

### Webhook Payload: PATCH Action

Source: https://docs.stackguardian.io/docs/organisation_settings/audit_logs

Example payload for a successful PATCH request involving permission updates.

```json
{
  "timestamp": 1757411989818,
  "message": {
    "id": "4e35d725-6e0b-4d58-a5e3-d72e48a393c2",
    "date_created": "2025-09-09T09:59:49",
    "action": "PATCH/api/v1/orgs/demo-org/roles/patch-wf-bugfix/",
    "actor": {
      "type": "user",
      "user": {
        "principalEmail": "user@stackguardian.io"
      }
    },
    "effect": "Allow",
    "sourceIp": "158.140.167.0",
    "timestamp": 1757411989,
    "request_body": {
      "AllowedPermissions": {
        "PATCH/api/v1/orgs/demo-org/wfgrps/<wfGrp>/stacks/<stack>/wfs/<wf>/": {
          "name": "UpdateStackWorkflow",
          "paths": {
            "<wfGrp>": [".*", ".*/.*"],
            "<stack>": [".*", ".*"],
            "<wf>": [".*", ".*"]
          }
        }
      }
    }
  }
}
```

--------------------------------

### Configure StackGuardian HTTP Backend

Source: https://docs.stackguardian.io/docs/deploy/workflows/workflows_types/opentofu/opentofu_configuration

Use the HTTP backend configuration to store OpenTofu state files remotely in StackGuardian. Replace placeholders with your specific organization, workflow, and authentication details.

```hcl
terraform {
  backend "http" {
    address  = "https://api.app.stackguardian.io/api/v1/orgs/[SG_ORG_ID]/wfgrps/[SG_WORKFLOW_GROUP_ID]/wfs/[WORKFLOW_OR_STACK_PATH]/artifacts/tfstate.json"
    retry_wait_min = 5 # The minimum time in seconds to wait between HTTP request attempts
    username = "SG_EMAIL"   # Can also be passed using TF_HTTP_USERNAME env var
    password = "SG_API_TOKEN"   # Can also be passed using TF_HTTP_PASSWORD env var
  }
}
```

```hcl
terraform {
  backend "http" {
    address  = "https://api.us.stackguardian.io/api/v1/orgs/[SG_ORG_ID]/wfgrps/[SG_WORKFLOW_GROUP_ID]/wfs/[WORKFLOW_OR_STACK_PATH]/artifacts/tfstate.json"
    retry_wait_min = 5 # The minimum time in seconds to wait between HTTP request attempts
    username = "SG_EMAIL"   # Can also be passed using TF_HTTP_USERNAME env var
    password = "SG_API_TOKEN"   # Can also be passed using TF_HTTP_PASSWORD env var
  }
}
```

--------------------------------

### Webhook Payload: POST Action

Source: https://docs.stackguardian.io/docs/organisation_settings/audit_logs

Example payload for a successful POST request, including request body and response details.

```json
{
  "timestamp": 1757412855196,
  "message": {
    "id": "b831d3a7-e450-4acc-b524-78c8c17768a5",
    "date_created": "2025-09-09T10:14:15",
    "action": "POST/api/v1/orgs/demo-org/wfgrps/workflow-delete-test/wfs/terraform-aws-vpc-stripped-new-d7kw/wfruns/",
    "actor": {
      "type": "user",
      "user": {
        "principalEmail": "user@stackguardian.io"
      }
    },
    "effect": "Allow",
    "sourceIp": "60.243.160.178",
    "timestamp": 1757412855,
    "request_body": {
      "TerraformAction": {
        "action": "destroy"
      },
      "EnableChaining": true
    },
    "request_method": "POST",
    "query_params": {},
    "response": {
      "OrgId": "/orgs/demo-org",
      "SubResourceId": "/wfgrps/workflow-delete-test/wfs/terraform-aws-vpc-stripped-new-d7kw/wfruns/ov9wr8nru04v",
      "CreatedAt": 1757412854960,
      "Comments": {
        "1757412854960": {
          "comment": "Workflow Run initiated",
          "createdBy": "user@stackguardian.io"
        }
      },
      "Statuses": {
        "pre_0_step": [
          {
            "name": "QUEUED",
            "createdAt": 1757412854960
          }
        ]
      },
      "LatestStatusKey": "pre_0_step",
      "ContextTags": {}
    }
  }
}
```

--------------------------------

### Sensitive Output JSON Representation

Source: https://docs.stackguardian.io/docs/deploy/workflows/workflow_components/outputs

Example of how sensitive output fields are masked in the JSON view when the sensitive flag is enabled.

```json
{
    "sensitive_outputs": {
        "sensitive": true,
        "type": [
            "tuple",
            [
                "number"
            ]
        ],
        "value": [
            "<sensitive>"
        ]
    }
}
```

--------------------------------

### Add StackGuardian to Gemini CLI

Source: https://docs.stackguardian.io/docs/mcp-server

Register the StackGuardian MCP server using the Gemini CLI command.

```bash
gemini mcp add StackGuardian https://api.app.stackguardian.io/mcp \
  --transport http \
  --header "SG_API_TOKEN: <YOUR_TOKEN>" \
  --header "SG_ORG: <YOUR_ORG>" --scope user
```

--------------------------------

### Apply Security Hardening

Source: https://docs.stackguardian.io/docs/develop/library/custom-runtime-image

Executes the hardening script as the final root step to secure the custom image.

```dockerfile
FROM <BASE_IMAGE>

USER root

RUN apk add --no-cache aws-cli
RUN pip install --no-cache-dir boto3

# Apply security hardening (must be the last RUN step as root)
RUN /usr/local/bin/harden.sh stackguardian

USER stackguardian
```

--------------------------------

### Define JSON Schema for Workflow Selection

Source: https://docs.stackguardian.io/docs/develop/library/nocode_template_builder

Example JSON schema defining a workflow selection dropdown and an output field.

```json
  {
    "$schema": "http://json-schema.org/schema#",
    "type": "object",
    "properties": {
        "workflows": {
            "type": "string",
            "title": "Workflow List",
            "description": "Select your workflow",
            "enum": [
                "CUSTOM-TEdH",
                "CUSTOM-4sg7",
                "test-26-May",
                "CUSTOM-gitlab",
                "CUSTOM-github",
                "aws-s3-demo-website-0OH2-Copy",
                "aws-s3-demo-website-0OH2"
            ]
        },
        "outputs": {
            "title": "Workflow Outputs",
            "type": "string"
        }
    }
 }
```