Strategies to Migrate NERM implementation from Dev to PROD

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,
I wanted to migrate Workflows from Dev env to PROD but not seeing if there is any quicker way to do it.

  1. Checked Configuration Hub, it does not have the option to create a NERM backup.
  2. Checked API calls, but the API call to create worflow won’t create the attributes and notification pages.
  3. There is configuration import but there is no configuration export option

Any insights are appreciated.

Thanks,
Vaibhav

2

Manually create workflows in the Production environment based on their Dev counterparts (i.e., recreate workflows, attributes, and notifications manually).

3

Configuration Export is at the configuration object level. Example - Select the check box next to the workflow, then go to the “3 dot menu” and select export (apologies but I don’t have a NERM tenant accessible currently to take a screen capture).

The exported object (workflow, attribute, page, form, etc.) will also contain ALL the related configuration objects. When doing the import to the next tenant you MUST review all the objects being created/modified to ensure you know what’s all being updated.

There are also a few caveats with the export/import process but that’s the topic for a blog post vs. simple post to answer the general question of migration from tenant to tenant.

4

I wouldn’t recommend manually recreating objects in the next environment. Each object (and sub-object) are assigned a GUID on creation which is the key for migration of the object. Without this you’ll NEVER be able to migrate things forward and you’ll have a very challenging maintenance issue.

5

Ed Marks pretty much nailed it. However, I will point out that you can review the export/import file in any code editor (VSCode Notepad++ etc). To get specific detail as to what is actually getting migrated.

I find this most useful when something is being “updated” by the system when you have not knowingly done anything to that specific object.

2 Likes
6

I will try this, I thought we can’t use the unique IDs of the dev environment and use them to upload in QA or PROD setup using configuration Import option.

I will see if this works and how exactly this works.

thanks,
Vaibhav

7

@coltonulmer - I agree with reviewing to see what’s there and honestly most of the time it’s nothing that’s been “changed” and it’s just included because it’s a related object.

A couple of items to watch for …

  • Security groups getting included that will overwrite configured security groups in the next environment.
  • Dependent objects that shouldn’t be moved yet (i.e. multiple changes in flight and the export grabs things that aren’t ready to move forward yet)
  • Deletion of items aren’t included (mostly seen within “Set Variables” where you remove something and the export has no way to capture this)
1 Like
8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.