☁️ Terraform Cloud / HCP Terraform: Enterprise Governance and Automation

Terraform Cloud (currently part of HCP Terraform) is HashiCorp's managed SaaS platform designed to facilitate continuous provisioning, team collaboration, centralized state management, and security governance in infrastructure as code.

1. What is Terraform Cloud and what problems does it solve?

While Terraform's on-premises CLI requires you to manually configure cloud credentials, remote backends, and runs on your local machine or CI/CD runners, Terraform Cloud offers a centralized platform that solves:

• Consistent Remote Executions: The plan and apply commands are executed within secure ephemeral containers in the HashiCorp cloud.

• Centralized and Attributable State Management: Audit trail of who executed what change, complete version history of tfstate and secure decompression.

• Access Control (RBAC): Integration with Single Sign-On (SSO / Okta / Entra ID) and definition of granular roles for developers and DevOps.

2. Workspaces in Terraform Cloud vs CLI Workspaces

Fundamental Difference: In the traditional Terraform CLI, a workspace is simply an isolated state file (.tfstate) for the same HCL code. In Terraform Cloud, a Workspace includes the state file, environment variables/secrets, Git VCS connections, automatic triggers, and approval rules.

3. Integration with Git (VCS-driven Workflow)

Terraform Cloud connects directly to GitHub, GitLab, Bitbucket, or Azure DevOps. This enables an automated GitOps flow:

1. A developer opens a Pull Request on GitHub.

1. Terraform Cloud detects the change and automatically executes a speculative terraform plan, commenting the result directly in the PR.

1. When approving and doing Merge to main, Terraform Cloud triggers terraform apply (may require prior manual approval).

4. Variable Sets and Secure Secret Management

Instead of spreading AWS/Azure credentials across dozens of repositories, Terraform Cloud allows you to create global or shared Variable Sets:

• Environment Variables: Cloud credentials (example: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY marked as Sensitive to never be visible in logs).

• Terraform Variables: HCL parameters that are dynamically injected into projects (example: environment = "production").

• Dynamic OIDC Integration: Passwordless authentication using temporary JWT tokens with AWS IAM, GCP Workload Identity or Azure Federated Credentials.

5. Policy as Code (Sentinel & OPA / Open Policy Agent)

To prevent security disasters before they occur in the cloud, Terraform Cloud allows you to evaluate the generated plan against mandatory institutional policies:

# Sentinel Policy
import "tfplan/v2" as tfplan

# Todos los buckets S3 creados deben ser privados
main = rule {
  all tfplan.resources.aws_s3_bucket as _, bucket {
    bucket.applied.acl != "public-read"
  }
}

6.Private Module & Provider Registry

Companies can publish and catalog their own internal Terraform Modules within their organization's Private Registry on Terraform Cloud, allowing developers to consume modules that are audited and approved by the security team.

7. Connecting your Local Project to Terraform Cloud

To link your local project with Terraform Cloud, add the cloud {} block inside the terraform {} block in your HCL file:

terraform {
  required_version = ">= 1.7.0"

  # Configuración del Backend SaaS de Terraform Cloud (HCP)
  cloud {
    organization = "maxis-computers-org"

    workspaces {
      name = "mc-platform-production"
    }
  }

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Login interactivo en la terminal para obtener token de API
terraform login

# Inicializa y sincroniza el Workspace remoto
terraform init

# Ejecuta el plan en los servidores de Terraform Cloud
terraform plan