> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Resolve issues

> Review and fix missing secrets, VCS connection gaps, or missing registry tokens flagged by the migration wizard before the Terraform Cloud migration.

Before migrating, the [TFC migration wizard](https://docs.envzero.com/guides/admin-guide/tfc-migration.md) checks your selected workspaces for issues that need resolution. It tells you exactly what needs attention. If no issues are found, you skip directly to review.

The **Next** button stays disabled until every issue is either resolved or explicitly skipped. The registry token warning does not block it.

## Issue types

### Missing secrets

TFC marks sensitive variables as write-only, so their values cannot be read during the scan. You need to re-enter these values before migration.

Missing secrets appear in two places:

* **Workspace variables** - sensitive variables defined on individual workspaces
* **Variable set variables** - sensitive variables defined in [variable sets](https://docs.envzero.com/guides/admin-guide/variables/variable-sets.md#coming-from-terraform-cloud) shared across workspaces. Each variable set card shows a badge listing every workspace that uses it, so you can see the full scope before deciding how to handle it.

**1. Click on a workspace or variable set card**

The card expands to show all sensitive variables that need values.

**2. Enter the secret values**

Provide the current value for each sensitive variable.

**3. Click Save Secrets**

The card updates to reflect the resolved status.

![Resolve missing secrets and VCS connections](https://mintcdn.com/envzero-b61043c8/VFw2NcRxIisIupl6/images/guides/admin-guide/tfc-migration-resolve-issues.png?fit=max\&auto=format\&n=VFw2NcRxIisIupl6\&q=85\&s=f36e4f8caf1b116f7710a70ac53c68c4)

> [!WARNING]
>
> **Skipping a secret removes it from the migrated environment.** Use **Skip for now** only for variables that are no longer needed. Any deployment that depends on a skipped variable will fail until the value is [added manually to the environment](https://docs.envzero.com/guides/admin-guide/variables.md#secrets) after migration.

### VCS connection required

Some workspaces reference VCS repositories through providers not yet [connected in env zero](https://docs.envzero.com/guides/admin-guide/manage-vcs.md). The wizard groups these issues by provider type and shows the repository name (`org/repo`) for each affected workspace.

For each provider, click the **Connect** button (for example, **Connect GitHub**). This opens an OAuth flow directly in the wizard. Once authenticated, all workspaces using that provider are unblocked at once.

> [!NOTE]
>
> Workspaces using VCS providers not supported by env zero are excluded at the workspace selection step and do not appear here.

### Registry token not set

TFC injects a registry token into its own runs, so there is no variable for migration to copy. env zero runs need the `TF_TOKEN_app_terraform_io` environment variable to fetch modules from your TFC private registry. Without it, `tofu init` fails with a 401 from `app.terraform.io`. Workspaces on a Terraform version below 1.6.0 migrate as Terraform, so their `terraform init` fails the same way.

The wizard lists a selected workspace here when both of the following are true:

* Your TFC organization has at least one private registry module. The wizard checks this during the scan, and does not check which modules each workspace uses. If the migration token cannot read the registry, the wizard cannot detect private modules and shows no warning.
* The workspace has no `TF_TOKEN_app_terraform_io` environment variable, directly or through a linked variable set.

This warning does not block the wizard. Set the token before you click **Create in env zero**, in one of these ways:

* In TFC, add `TF_TOKEN_app_terraform_io` as a sensitive environment variable on the workspace or a variable set. Then go back to the Select Scope step and click [**Re-scan**](https://docs.envzero.com/guides/admin-guide/tfc-migration/connect-and-scan.md#re-scanning). The variable then appears under [missing secrets](#missing-secrets), where you enter its value.
* In env zero, add it as a sensitive environment variable at the organization level, or in a [variable set](https://docs.envzero.com/guides/admin-guide/variables/variable-sets.md) assigned to the organization.

Use a TFC user or team API token that can read the private registry. Environment variable credentials need Terraform 1.2 or later, or OpenTofu. For what happens if you set it after migration, see [Set the registry token for private modules](https://docs.envzero.com/guides/admin-guide/tfc-migration/go-live.md#set-the-registry-token-for-private-modules).

## No issues found

If all selected workspaces pass validation, the wizard displays a success message and you can proceed directly to the next step.

## Next steps

* [Review your selection and start the migration](https://docs.envzero.com/guides/admin-guide/tfc-migration/review-and-migrate.md)
* [Troubleshoot missing secrets](https://docs.envzero.com/guides/admin-guide/tfc-migration/troubleshooting.md#missing-secrets-not-resolving) if a workspace still reports them


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.