Terraform Cloud

HashiCorp's managed platform for Terraform — remote state storage, locked execution environments, team access controls, cost estimation, and Sentinel policy enforcement with zero infrastructure to manage.

What is Terraform Cloud?

Terraform Cloud (TFC) is HashiCorp's managed SaaS platform that extends open-source Terraform with collaboration, security, and governance features. At its core it solves three problems that arise when teams use Terraform: state management (where is the state file and who can access it?), execution consistency (runs on different machines produce different results due to different provider versions), and team workflows (who approved this apply and when?).

TFC organizes work into workspaces — each workspace is an isolated Terraform working directory with its own state, variables, run history, and access controls. Workspaces map loosely to environments (dev/staging/prod) or infrastructure components (vpc/eks/rds). Runs (plans and applies) execute on HashiCorp-managed compute in an isolated, reproducible environment.

Configuring Remote State

Add the cloud block to your Terraform configuration to store state in Terraform Cloud:

# main.tf — configure Terraform Cloud backend
terraform {
  required_version = ">= 1.1.0"

  cloud {
    organization = "my-org"

    workspaces {
      name = "api-production"
    }
  }

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Authenticate via environment variable or interactive login
# export TF_TOKEN_app_terraform_io="your-api-token"
# OR run: terraform login

VCS-Driven Workflow (GitHub Integration)

Connect a workspace to your GitHub repository for automatic plan-on-PR and apply-on-merge workflows:

# In Terraform Cloud UI:
# Workspace → Settings → Version Control → Connect to VCS
# Install the Terraform Cloud GitHub App
# Select repository and configure:
#   - Working directory: infra/aws/production
#   - Trigger: Only files in working directory
#   - Auto apply: enabled for main branch only

# PR workflow (automatic):
# 1. Developer opens PR → TFC runs terraform plan
# 2. Plan output posted as PR comment
# 3. Reviewer approves the plan in TFC UI
# 4. PR merged → TFC runs terraform apply automatically
# 5. Apply output stored in run history with committer identity

Cross-Workspace Remote State

# In producer workspace (vpc-production), expose outputs:
output "vpc_id" {
  value = aws_vpc.main.id
}
output "private_subnet_ids" {
  value = aws_subnet.private[*].id
}

# In consumer workspace (eks-production), read remote state:
data "terraform_remote_state" "vpc" {
  backend = "remote"
  config = {
    organization = "my-org"
    workspaces = {
      name = "vpc-production"
    }
  }
}

resource "aws_eks_cluster" "main" {
  name     = "production"
  role_arn = aws_iam_role.eks.arn

  vpc_config {
    subnet_ids = data.terraform_remote_state.vpc.outputs.private_subnet_ids
  }
}

# Also enable remote state sharing in TFC:
# vpc-production workspace → Settings → Remote state sharing → Add eks-production

Sentinel Policy Enforcement

# policies/require-s3-versioning.sentinel
import "tfplan/v2" as tfplan

# Find all S3 bucket resources in the plan
s3_buckets = filter tfplan.resource_changes as _, rc {
  rc.type is "aws_s3_bucket" and
  rc.mode is "managed" and
  rc.change.actions contains "create"
}

# Policy rule: all new S3 buckets must enable versioning
main = rule {
  all s3_buckets as _, bucket {
    bucket.change.after.versioning[0].enabled is true
  }
}

# policy-set configuration (sentinel.hcl):
# policy "require-s3-versioning" {
#   source            = "./policies/require-s3-versioning.sentinel"
#   enforcement_level = "soft-mandatory"
# }

GitHub Actions Integration

# .github/workflows/terraform.yml
name: Terraform CI

on:
  pull_request:
    paths: ['infra/**']
  push:
    branches: [main]
    paths: ['infra/**']

jobs:
  terraform:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra/aws/production
    env:
      TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}

    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "~1.7"
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        if: github.event_name == 'pull_request'
        run: terraform plan -no-color

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve

Terraform Cloud vs Terraform Enterprise vs Local

Best Practices

• Use one workspace per environment per infrastructure component (e.g., vpc-dev, vpc-prod, eks-prod)
• Store sensitive variables (AWS keys, database passwords) as sensitive workspace variables — never in .tfvars files committed to Git
• Enable cost estimation and review it before approving applies to avoid surprise AWS bills
• Use run triggers to automatically re-plan downstream workspaces when upstream state changes
• Pin Terraform and provider versions to avoid unexpected behavior from automatic upgrades
• Enable the "Require two-factor authentication" organization setting for all users