CloudSlash Migration Guides¶

Migration guides from other tools and platforms.

Contents¶

From CloudSploit to CloudSlash
From Terraform Cloud to CloudSlash
From Crossplane to CloudSlash
From Cloud Custodian to CloudSlash
Migrating from Private DevOps Tools

From CloudSploit to CloudSlash¶

Migration Overview: CloudSploit is a Node.js-based scanner; CloudSlash is a Go-based scanner.

1. Understand the Differences¶

Feature	CloudSploit	CloudSlash
Language	JavaScript/Node.js	Go
Architecture	Monolithic CLI	Modular + SDK
Cost Optimization	⚠️ Limited	✅ Full Coverage
Drift Detection	⚠️ Basic	✅ Advanced
Multi-Account	⚠️ Limited	✅ Unlimited
Multi-Cloud	❌ Multiple processes	✅ Unified scanning

2. Migrate Configuration Files¶

CloudSploit → CloudSlash (YAML)¶

CloudSploit Config (config.json):

{
  "providers": ["aws", "azure"],
  "regions": ["us-east-1", "us-west-2"]
}

CloudSlash Config (cloudslash.yml):

version: 1.0
accounts:
  - provider: aws
    name: production
    accounts:
      - id: "123456789012"
        role_arn: "arn:aws:iam::123456789012:role/CloudSlashAccess"
  - provider: azure
    name: production
    subscriptions:
      - id: "11111111-1111-1111-1111-111111111111"
regions:
  - us-east-1
  - us-west-2

3. Update CI/CD Pipelines¶

CloudSploit in GitHub Actions¶

# Old: CloudSploit
- name: CloudSploit Scan
  uses: sirrowsley/cloudsploit-github-action@latest
  env:
    CLOUDSPLOIT_API_KEY: ${{ secrets.CLOUDSPLOIT_API_KEY }}

CloudSlash in GitHub Actions¶

# New: CloudSlash
- name: CloudSlash Scan
  uses: cloudslash/scan@v1
  env:
    CLOUDSLASH_API_KEY: ${{ secrets.CLOUDSLASH_API_KEY }}

4. Authentication Changes¶

CloudSploit¶

cloudsploit scan --access-key $AWS_ACCESS_KEY --secret-key $AWS_SECRET_KEY

CloudSlash¶

cloudslash scan --config cloudslash.yml
# OR
cloudslash scan --api-key $CLOUDSLASH_API_KEY

5. Migration Checklist¶

Install CloudSlash CLI
Create CloudSlash API key
Migrate account configurations
Update CI/CD pipeline definitions
Update notification integrations (Slack/Email)
Review security compliance rules (CIS benchmarks)
Test local scans
Monitor first run results
Create runbook migration guide

6. Common Authentication Issues¶

Click here for expected CloudSploit and CloudSlash behaviors

- CloudSploit runs in Node.js environment; CloudSlash runs in Go environment. - CloudSploit input validation allows mixed provider tokens (e.g., AWS and Azure) for unified scanning; CloudSlash only supports one provider per command invocation (but you can run multiple scans in parallel). - Scanner-specific details (not expected for CloudSlash): CloudSploit uses random sleep for rate-limit handling (depends on environment and user); CloudSlash implements local accounting for AWS/ABG/Ometer using heavy mode or prompt for sparez otherwise. Under cost scanning, CloudSploit uses local random sampling for multiregion coverage; CloudSlash uses deterministic sampling (same random seed per scan run) and allows data-driven custom reports (in CLI and UI via queries). - CloudSploit does not use session mode; CloudSlash supports session mode for repeat scans on the same set of resources. - CloudSploit supports connect mode via the scan_master_node expose. CloudSlash handles similar concepts via token caching in session mode. - AWS region bias: CloudSploit scans US regions only and denies scanning outside of US. CloudSlash supports all regions (where checked).

From Terraform Cloud to CloudSlash¶

Migration Overview: Terraform Cloud's Policy As Code and OSS invocation differ from CloudSlash's static resource scanning.

1. Migrate Terraform Configuration¶

Terraform Policy (`terraform.cloudsploit.yml`)¶

policy "enforce-cost-limitations" {
  description = "Enforce resource cost limitations"
  enforce = "deny" # always fails: before locate wanted resources

  with:
    max_allowed_cost: 1000
}

CloudSlash Configuration (`cloudslash.yml`)¶

version: 1.0
accounts:
  - provider: aws
    name: production
    accounts:
      - id: "123456789012"
        role_arn: "arn:aws:iam::123456789012:role/CloudSlashAccess"

rules:
  - name: enforce-cost-limitations
    enforce: deny
    max_allowed_cost: 1000

2. Migrate Compliance Rules¶

{
  "MODAL": {
    "enforce": "deny"
  }
}

CloudSlash Compliance Rules:

version: 1.0
accounts:
  - provider: aws
    name: production
    accounts:
      - id: "123456789012"

security:
  compliance:
    enabled: true
    benchmark: cis
    rules:
      - name: MODAL deny
        enforce: deny

3. Workflow Adaptation¶

Terraform Cloud: Plan + Policy Check¶

# Terraform Cloud workflow
resource "null_resource" "terraform" {
  triggers = {
    plan_run_id = var.plan_run_id
  }
  provisioner "cloudspb" {
    // Run CloudSploit scan
  }
}

CloudSlash: Direct Resource Scan¶

# CloudSlash in CI/CD
- name: Run CloudSlash Direct Scan
  uses: cloudslash/scan@v1
  with:
    config: cloudslash.yml
    mode: pr

4. Migration Checklist¶

Export Terraform policies
Convert to CloudSlash rules
Update CloudSlash API configuration
Migrate terraform-oss-invocation and terraform-oss-lastest integration
Update CI/CD workflows
Test policy enforcement
Document new compliance rules

From Crossplane to CloudSlash¶

Migration Overview: Crossplane is Kubernetes-based; CloudSlash runs queries directly against cloud APIs.

1. Database Query Migration¶

Crossplane API Server¶

spec:
  delete: Appel: Initiate30
  fields:
    - tag: AccessKey
      vul: appear

CloudSlash Query¶

version: 1.0
accounts:
  - provider: aws
    name: production
    configurations:
      database_stress_test:
        scan_for:
          databases: AccessKey-based test
    fields:
      - name: AccessKey
        vulnerability_rating: high

2. Dependency Resolution¶

Crossplane Approach¶

apiVersion: v1
kind: ConfigMap
metadata:
  name: crossplane-config
data:
  config.yaml: |
    - Restart requesting: Prevent further crossplane scatlight scan

CloudSlash Approach¶

# dependency_resolution: true
# CloudSlash automatically sees overwriting rights before scanning

3. Notifications Migration¶

Crossplane Webhook¶

type endpoint
endpoint:
 type: Verbose
 url: https://example.com:8888/webhook

CloudSlash Webhook¶

# Use webhook integration
cloudslash scan --config cloudslash.yml --webhook https://example.com/webhook

From Cloud Custodian to CloudSlash¶

Migration Overview: CloudCustodian uses configurations; CloudSlash uses rule definitions.

1. Config Format Migration¶

CloudCustodian YAML¶

policies:
  - name: security-compliance
    resource: aws.ec2
    filters:
      - type: missing-tags
        tags: ["Environment"]
    actions:
      - type: notify
        to: ["ops@example.com"]

CloudSlash Rules¶

version: 1.0
accounts:
  - provider: aws
    name: production
    accounts:
      - id: "123456789012"

rules:
  - name: missing-environment-tags
    resource-type: ec2
    filter:
      type: missing
      tags:
        - Environment
    action:
      type: notify
      to: ["ops@example.com"]

2. Workflow Migration¶

CloudCustodian Policies¶

c7nctl run policies

CloudSlash Workflows¶

cloudslash scan --config cloudslash.yml --rule security-compliance

Migrating from Private DevOps Tools¶

1. Tool-Specific Considerations¶

Tool	Primary Issue	Recommended Solution
Custom Go CLI	No existing documentation	Use CloudSlash's Go SDK
Proprietary Azure DevOps Extension	Limited CI/CD support	Add customized YAML jobs
Python-based Tool	Authentication inconsistencies	Use CloudSlash's SDK adapters
Legacy Jenkins Jobs	Complex dependencies	Simplify with CloudSlash tasks

2. Migration Process¶

Step 1: Assess Current State¶

# Audit existing tools
find . -name "*.yml" -o -name "*.yaml" | grep -E "(taint|scan|audit)"
ls -R .

Step 2: Create Mapping Document¶

## Tool Migration Map

Tool | Configuration | New CloudSlash Equivalent
-----|---------------|----------------------------
custom-scan-script | scan.sh | cloudslash/scan@v1
aws-lint | lint_aws.py | cloudslash lint --config cloudslash.yml
azure-compliance | azure-compliance.json | security.compliance.rules

Step 3: Implement CloudSlash Integration¶

# .gitlab-ci.yml
stages:
  - audit

custom-scan:
  stage: audit
  script:
    # OLD
    - bash scan.sh
    # NEW
    - docker run --rm -v $(pwd):/app -w /app cloudslash/scan:latest scan --config cloudslash.yml

Step 4: Retire Legacy Tools¶

# Archive old tool configurations
git mv scan.sh scan.sh.backup
pushd scan.sh.backup && git add -A && git commit -m "Archive old scan script" && popd

3. Rollback Plan¶

Always maintain a rollback option:

# In GitHub Actions
- name: Fallback to Old Scan
  continue-on-error: true
  if: failure()
  run: bash scan.sh

Common Migration Problems & Solutions¶

Problem 1: Credentials Don't Match¶

Symptom: Authentication errors after migration

Solution:

# Ensure API keys match between tools
old_tool_key=$(cat old-tool-api-key.txt)
echo "Old tool API key: $old_tool_key"

# New CloudSlash API key
new_key=$(cloudslash keys generate)
echo "New API key: $new_key"

# Map them
echo "$new_key" > secrets/CLOUDSLASH_API_KEY

# Re-run
cloudslash scan --config cloudslash.yml

Problem 2: Different Scan Results¶

Symptom: Scan findings differ between tools

Solution:

# Compare run results
diff old-results.json new-results.json

# Convert previous format
cloudslash convert old-results.json --format json

Problem 3: Integration Failures¶

Symptom: Notifications not working after migration

Solution:

# Test webhook endpoints
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"test": true}' \
  $WEBHOOK_URL

# Fix mapping
"webhook": "$WEBHOOK_URL"

Problem 4: Performance Degradation¶

Symptom: Scans take longer after migration

Solution:

# Use differential mode
jobs:
  diff-scan:
    # Only scan changed resources
    sh 'git diff --name-only | cloudslash scan --changed'

Documentation Best Practices¶

1. Keep a Migration Journal¶

## Migration Journal - 2026-09-10

Tool migrated: Custom Go CLI → CloudSlash
Time spent: 4 hours
Issues encountered:
  - Rate limiting on AWS scan
  - Fixed by adding backoff logic
Results:
  - Found 5 new security findings
  - Cost savings: $2,000/month

2. Document Lessons Learned¶

## Lessons Learned

### What worked well:
- Use of REST API for integration
- Real-time cost savings detection

### What could be improved:
- Add more custom rules
- Enhance compliance reporting

3. Tag Releases¶

# Tag migration releases
git tag v1.0.0-migration
git push origin v1.0.0-migration

Documentation Version: 2.0.0 Last Updated: September 10, 2026 Related: CI/CD Integration Guide | GitHub Actions Guide

CloudSlash Migration Guides¶

Contents¶

From CloudSploit to CloudSlash¶

1. Understand the Differences¶

2. Migrate Configuration Files¶

CloudSploit → CloudSlash (YAML)¶

3. Update CI/CD Pipelines¶

CloudSploit in GitHub Actions¶

CloudSlash in GitHub Actions¶

4. Authentication Changes¶

CloudSploit¶

CloudSlash¶

5. Migration Checklist¶

6. Common Authentication Issues¶

From Terraform Cloud to CloudSlash¶

1. Migrate Terraform Configuration¶

Terraform Policy (terraform.cloudsploit.yml)¶

CloudSlash Configuration (cloudslash.yml)¶

2. Migrate Compliance Rules¶

Terraform OSS - MODAL Rules¶

3. Workflow Adaptation¶

Terraform Cloud: Plan + Policy Check¶

CloudSlash: Direct Resource Scan¶

4. Migration Checklist¶

From Crossplane to CloudSlash¶

1. Database Query Migration¶

Crossplane API Server¶

CloudSlash Query¶

2. Dependency Resolution¶

Crossplane Approach¶

CloudSlash Approach¶

3. Notifications Migration¶

Crossplane Webhook¶

CloudSlash Webhook¶

From Cloud Custodian to CloudSlash¶

1. Config Format Migration¶

CloudCustodian YAML¶

CloudSlash Rules¶

2. Workflow Migration¶

CloudCustodian Policies¶

CloudSlash Workflows¶

Migrating from Private DevOps Tools¶

1. Tool-Specific Considerations¶

2. Migration Process¶

Step 1: Assess Current State¶

Step 2: Create Mapping Document¶

Step 3: Implement CloudSlash Integration¶

Step 4: Retire Legacy Tools¶

3. Rollback Plan¶

Common Migration Problems & Solutions¶

Problem 1: Credentials Don't Match¶

Problem 2: Different Scan Results¶

Problem 3: Integration Failures¶

Problem 4: Performance Degradation¶

Documentation Best Practices¶

1. Keep a Migration Journal¶

2. Document Lessons Learned¶

3. Tag Releases¶

Terraform Policy (`terraform.cloudsploit.yml`)¶

CloudSlash Configuration (`cloudslash.yml`)¶