HCP Terraform

Full State Sequence

• Pending — run is queued, waiting for a worker
• Planning — terraform plan executing on HCP agent; logs streaming
• Planned — plan complete; awaits human confirmation (or auto-apply if enabled)
• Applying — terraform apply executing; changes being made
• Applied — run successful; state updated
• Errored / Discarded / Canceled — terminal failure/abort states

Speculative Plans

Triggered by pull requests in VCS-driven workspaces. They show what would change without requiring approval or applying anything. Results post back to the PR as a check. No state is modified.

Plan & Apply on HCP Agents

When using remote operations, terraform plan and terraform apply execute on HCP Terraform's managed infrastructure — not your local machine. Log output streams back to your browser UI or CLI in real time. Your local machine only needs the cloud block configured and valid credentials via terraform login.

Teams

Groups of users within an HCP Terraform organization. Teams receive workspace-level permissions:

• Read — view state, plans, variables
• Plan — trigger speculative plans
• Write — queue runs, approve plans, manage variables
• Admin — full workspace control including settings and team assignments

Sentinel — Policy as Code

HashiCorp's built-in policy framework. Policies are written in the Sentinel language and applied to runs before apply executes.

OPA (Open Policy Agent)

Alternative policy framework. Policies written in Rego language. OPA is a CNCF-graduated project widely used outside HashiCorp tooling. Both Sentinel and OPA policies can be organized into policy sets — collections applied to specific workspaces or all workspaces in an organization.

Drift Detection

Scheduled checks that compare the Terraform state file to real infrastructure in the cloud. If the two diverge (e.g., someone manually deleted a resource), HCP Terraform alerts on drift without automatically triggering an apply. Part of the broader Health Assessments feature which also runs Sentinel policy checks continuously.

Explorer

Cross-workspace resource inventory built into HCP Terraform. Lets you search and audit resources managed across all workspaces in an organization from a single view — useful for compliance and sprawl management.

Workspace-to-Workspace Dependencies

A run trigger causes Workspace B to automatically queue a plan when Workspace A successfully applies. This models infrastructure dependencies — e.g., a networking workspace finishing before application workspaces start. Run triggers chain workspaces without requiring manual intervention.

Reusable Variable Collections

Variable sets are named collections of Terraform variables and environment variables that can be shared across multiple workspaces, eliminating copy-paste of common config (e.g., AWS credentials, region). Scope options:

• Organization-wide — applied automatically to every workspace
• Project-scoped — applied to all workspaces within a project
• Workspace-specific — applied to designated workspaces only

Precedence: Workspace variables override variable sets. TF_VAR_ environment variables set in workspace settings behave identically to CLI environment variables.

Modern Integration Approach

Replace a backend block with the cloud block inside terraform {} to connect your workspace to HCP Terraform:

terraform {
  cloud {
    organization = "my-org"
    workspaces {
      name = "my-workspace"
    }
  }
}

After adding the block, run terraform init to set up the remote backend and download providers for remote execution. If migrating existing state, terraform init prompts you to confirm the migration.

Remote Execution from Local CLI

With the cloud block and a valid token, running terraform plan or terraform apply locally submits the run to HCP Terraform where it executes remotely. Log output streams back to the terminal in real time. Your local .tf files define configuration; HCP Terraform manages state and execution environment.

• terraform init — configures remote backend; -upgrade flag upgrades providers to newest allowed versions
• Local .tf files are uploaded to HCP Terraform for each run
• State never touches your local disk when using remote operations