Terraform Cloud — Remote Execution & Workspace Management Guide

# Install the Terraform CLI
sudo apt-get update && sudo apt-get install -y gnupg software-properties-common
wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install terraform

# Login to Terraform Cloud
terraform login

# Expected output:
# Terraform will request an API token for app.terraform.io
# Generate a token in TFC > User Settings > Tokens
# Enter a value: <your-token>
# Success! Terraform has obtained and saved an API token.

# main.tf
terraform {
  cloud {
    organization = "dodatech"

    workspaces {
      name = "production-networking"
    }
  }
}

# Or use tags for workspace selection
terraform {
  cloud {
    organization = "dodatech"

    workspaces {
      tags = ["production", "networking"]
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# variables.tf — mark sensitive variables
variable "aws_access_key" {
  description = "AWS access key"
  type        = string
  sensitive   = true
}

variable "aws_secret_key" {
  description = "AWS secret key"
  type        = string
  sensitive   = true
}

variable "instance_count" {
  description = "Number of EC2 instances"
  type        = number
  default     = 3
}

variable "environment" {
  description = "Environment name"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "Environment must be dev, staging, or production."
  }
}

# Initialize with remote backend
terraform init

# Expected output:
# Initializing Terraform Cloud...
# Initializing provider plugins...
# Terraform has been successfully initialized!

# Plan (runs on TFC, not locally)
terraform plan

# Expected output:
# Running plan in Terraform Cloud. Output will stream here.
# ...
# Plan: 5 to add, 0 to change, 0 to destroy.

# Apply (runs on TFC)
terraform apply

# Expected output:
# Running apply in Terraform Cloud. Output will stream here.
# ...
# Apply complete! Resources: 5 added, 0 changed, 0 destroyed.

# terraform.tfc.hcl — VCS branch configuration
# This file lives in your repository root

terraform {
  cloud {
    organization = "dodatech"

    workspaces {
      tags = ["production"]
    }
  }
}

# policies/enforce-mandatory-tags.sentinel
import "tfplan"

mandatory_tags = ["Environment", "Owner", "CostCenter", "ManagedBy"]

all_resources = filter tfplan.resource_changes as _, rc {
    rc.mode == "managed" and
    rc.type not in ["null_resource", "terraform_data"]
}

violations = []

for all_resources as _, resource {
    for mandatory_tags as tag {
        if tag not in resource.applied.tags else null {
            violations = append(violations,
                resource.address + " is missing tag: " + tag)
        }
    }
}

main = rule {
    length(violations) == 0
}

# policies/restrict-instance-types.sentinel
import "tfplan"

allowed_instance_families = ["t3", "m6i", "r6g", "c6i"]

compute_resources = filter tfplan.resource_changes as _, rc {
    rc.type in ["aws_instance", "aws_launch_template"]
}

for compute_resources as _, resource {
    instance_type = resource.applied.instance_type else resource.drifted.instance_type

    family = split(instance_type, ".")[0]

    if family not in allowed_instance_families {
        print(resource.address + " uses " + instance_type + " (not allowed)")
        main = false
    }
}

main = rule { main is true }

# Configure Run Task in TFC UI:
# Settings > Run Tasks > Create

# Example: Infracost cost estimation run task
runTask:
  name: Infracost
  url: https://infracost-api.dodatech.com/tfc-task
  category: pre_plan
  hmac_key: your-hmac-secret

# Example: Checkov security scanning run task
runTask:
  name: Checkov
  url: https://checkov.dodatech.com/tfc-task
  category: pre_apply
  hmac_key: your-hmac-secret

# teams.tf — manage teams via Terraform
resource "tfe_team" "platform" {
  name         = "platform-engineers"
  organization = "dodatech"
}

resource "tfe_team" "security" {
  name         = "security-engineers"
  organization = "dodatech"
}

resource "tfe_team_access" "platform_prod" {
  access       = "write"
  team_id      = tfe_team.platform.id
  workspace_id = tfe_workspace.production.id
}

resource "tfe_team_access" "security_prod" {
  access       = "plan"
  team_id      = tfe_team.security.id
  workspace_id = tfe_workspace.production.id
}