WizConnection

The Wiz service account the tenant authorised. One per tenant. Wiz is connected as an addition to AWS: each claim Wiz makes is checked from inside the AWS account, so a plan is refused until AWS is connected, and on a plan without cloud integrations. Apply checks the credential against Wiz before it is stored, including that the service account can read audit data (admin:audit). The client secret is kept in the tenant’s vault and is never exported, shown in a plan or returned by any endpoint. A connection is created and deleted, never edited: any change replaces it (the old connection is deleted and its stored secret revoked, then the new one is created and checked). Deleting the document disconnects Wiz and stops the sync; findings already ingested from Wiz, and their triage history, are kept.

apiVersion	vulnetix.com/v1
kind	WizConnection
Group	Integrations
Status	Served. The config engine plans and applies it.
Objects per tenant	one (metadata.name: default)
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists WizConnection in its kinds. See Management tokens.
Secret fields	spec.clientSecret: read on the client from valueFrom, sent once, never exported or shown in a plan
Terraform resource	vulnetix_wiz_connection, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/WizConnection.schema.json
Newest schema	latest/WizConnection.schema.json
First released in	v1.5.0
Print the built-in copy	vulnetix config schema WizConnection

Minimal

Only the fields the kind requires. From examples/WizConnection/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/WizConnection.schema.json
apiVersion: vulnetix.com/v1
kind: WizConnection
metadata:
  name: default
spec:
  clientId: 4ba3c9f2d7e14a6b8c0d1e2f3a4b5c6d
  tenantDatacenter: us17

HCL (resource vulnetix_wiz_connection)

# Only the arguments the kind requires. From config-schemas examples/WizConnection/minimal.yaml.

resource "vulnetix_wiz_connection" "default" {
  client_id         = "4ba3c9f2d7e14a6b8c0d1e2f3a4b5c6d"
  tenant_datacenter = "us17"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/WizConnection.schema.json
apiVersion: vulnetix.com/v1
kind: WizConnection
metadata:
  name: default
spec:
  clientId: 4ba3c9f2d7e14a6b8c0d1e2f3a4b5c6d
  tenantDatacenter: us17
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/WizConnection/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/WizConnection.schema.json
# Connect AWS first: Wiz findings are verified from inside the account.
apiVersion: vulnetix.com/v1
kind: WizConnection
metadata:
  name: default
  labels:
    owner: cloud-security
  annotations:
    note: The service account needs the admin:audit permission.
spec:
  clientId: 4ba3c9f2d7e14a6b8c0d1e2f3a4b5c6d
  tenantDatacenter: us17
  clientSecret: { env: VULNETIX_WIZ_CLIENT_SECRET }

HCL (resource vulnetix_wiz_connection)

# Every argument the kind supports. From config-schemas examples/WizConnection/advanced.yaml.

variable "default_client_secret" {
  type      = string
  sensitive = true
  ephemeral = true
}

resource "vulnetix_wiz_connection" "default" {
  client_id                = "4ba3c9f2d7e14a6b8c0d1e2f3a4b5c6d"
  client_secret_wo         = var.default_client_secret
  client_secret_wo_version = 1
  tenant_datacenter        = "us17"
  labels = {
    owner = "cloud-security"
  }
  annotations = {
    note = "The service account needs the admin:audit permission."
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
export VULNETIX_WIZ_CLIENT_SECRET=...   # read on this machine by valueFrom, never written to the document
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/WizConnection.schema.json
# Connect AWS first: Wiz findings are verified from inside the account.
apiVersion: vulnetix.com/v1
kind: WizConnection
metadata:
  name: default
  labels:
    owner: cloud-security
  annotations:
    note: The service account needs the admin:audit permission.
spec:
  clientId: 4ba3c9f2d7e14a6b8c0d1e2f3a4b5c6d
  tenantDatacenter: us17
  clientSecret: { env: VULNETIX_WIZ_CLIENT_SECRET }
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Secret	Description
apiVersion	string	yes		exactly vulnetix.com/v1		The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly WizConnection		Always WizConnection.
metadata	object	yes		no other keys		Metadata for a kind the tenant has exactly one of. The name is fixed to default.
metadata.name	string	yes		exactly default; pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$		The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid		The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$		Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)		Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.clientId	string	yes		pattern ^\S+$; length 1 to 256		The service account’s client id, from Settings, Service Accounts in the Wiz console.
spec.tenantDatacenter	string	yes		pattern ^[a-z0-9-]+$; length 1 to 32		The datacenter segment of the tenant’s API host: us17 for api.us17.wiz.io. It is the part of the Wiz console URL before .wiz.io.
spec.clientSecret	object	no		1 to 1 keys; no other keys	yes	Where the client reads the service account’s client secret. Required when the connection is created; left out afterwards, the stored secret is kept, including when another change replaces the connection.
spec.clientSecret.env	string	no		pattern ^[A-Za-z_][A-Za-z0-9_]*$		Name of an environment variable.
spec.clientSecret.file	string	no		length 1 to any		Path to a file holding the value. Trailing newlines are trimmed.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.
• Singleton. There is one per tenant, and its name is always default.

How apply treats it

One per tenant. The console only creates and deletes a Wiz connection, so a change replaces it through those writers. The client secret is a valueFrom secret.

Terraform and OpenTofu

The resource is vulnetix_wiz_connection in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_wiz_connection.

Import an object that already exists by its name (default):

# Import an existing WizConnection by its name (metadata.name).
terraform import vulnetix_wiz_connection.default default

A secret is two arguments, never stored in the plan or the state: client_secret_wo (write-only) and client_secret_wo_version. Change the version number to send a new value. See Secrets.

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.