TFLAB34-HCP Terraform: Cloud Block, Login and Remote Runs

HCP Terraform: Cloud Block, Login and Remote Runs

🔧 HCP Terraform ⭐ Intermediate cloud {} block terraform login CLI-Driven Runs Variable Sets

Scenario

Your team wants to move from a DIY S3 backend to HCP Terraform (formerly Terraform Cloud). HCP Terraform provides managed state storage, remote execution, team collaboration, and policy enforcement — all without managing your own backend infrastructure.

Your Objectives
  • Run terraform login to authenticate with HCP Terraform.
  • Add a cloud {} block with organization and workspace.
  • Run terraform init to migrate to HCP Terraform.
  • Understand CLI-driven vs VCS-driven run workflows.
  • Understand variable sets for sharing variables across workspaces.

Additional Context

The cloud {} block replaces the older backend "remote" {} configuration. It lives inside the terraform {} block and is mutually exclusive with any backend block.

CLI-driven runs: You run terraform plan/apply from your local CLI, but execution happens remotely on HCP Terraform runners. VCS-driven runs: HCP Terraform watches a Git repo and automatically triggers plans on pull requests and applies on merge.

Variable Sets let you define variables (like AWS credentials) once and share them across multiple workspaces — no need to configure credentials per workspace.

Step 1: Login to HCP Terraform

# Authenticate with HCP Terraform (app.terraform.io)
terraform login
# Opens a browser → generate API token → paste it back
# Token is stored in ~/.terraform.d/credentials.tfrc.json

main.tf (with cloud block)

terraform {
  required_version = ">= 1.5.0"

  # cloud {} block — replaces backend "remote" {}
  cloud {
    organization = "my-org"        # your HCP Terraform org name

    workspaces {
      name = "demo-workspace"      # single workspace
      # OR use tags for multiple workspaces:
      # tags = ["app:demo", "env:dev"]
    }
  }

  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" { region = "us-east-1" }

resource "aws_s3_bucket" "demo" {
  bucket = "hcp-tf-demo-bucket"
  tags   = { ManagedBy = "terraform", Source = "hcp-terraform" }
}

Workflow Commands

# Login (one-time)
terraform login

# Init migrates state to HCP Terraform
terraform init
# "Migrating from backend "local" to HCP Terraform..."

# Plan/Apply — executes REMOTELY on HCP runners
terraform plan    # runs on HCP Terraform, streams output back
terraform apply   # runs remotely, requires approval in CLI or UI

# Variable sets: configure in HCP Terraform UI
# Settings → Variable Sets → Add Variable Set
# Add AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY as env vars
# Scope to all workspaces or specific ones

terraform destroy
✓ Remote Execution Output
Running plan in HCP Terraform. Output will stream here.

Terraform v1.7.0
on linux_amd64
Initializing plugins and modules...

Plan: 1 to add, 0 to change, 0 to destroy.

Related Posts