Demo Interacting with Terraform Cloud

In this lesson, you’ll learn how to sign in and interact with Terraform Cloud through the web UI, CLI, and API. We’ll cover user and organization-level security settings, SSH key management, and token types.

1. Logging into Terraform Cloud Web UI

Navigate to the Terraform Cloud login page and enter your HCP account or username/email credentials.
If you belong to multiple organizations, select the one you want to access.

2. Configuring User-Level Authentication

Click your user avatar and select User Settings → Account Settings.
Under Authentication, enable Two-Factor Authentication (2FA). You can choose an authentication app or SMS.
For app-based 2FA, scan the QR code and enter the generated one-time password.

Warning

Always save your backup codes in a secure location. Losing access to your 2FA device can lock you out of Terraform Cloud.

Once verified, 2FA is active on your account.

3. Organization-Level Security Policies

Switch to your organization (e.g., Mastering Terraform Cloud), then go to Settings → Authentication. Here you can:

Require that all members enable 2FA
Configure session inactivity timeouts
Set reauthentication intervals

The image shows a web interface for managing two-factor authentication settings, with options to disable 2FA and reveal backup codes. It includes a dropdown menu for selecting an organization.
The image shows a settings page for authentication in Terraform Cloud, detailing user session timeout and two-factor authentication options. It includes fields for setting session timeout and reauthentication intervals, with options to update user sessions and require two-factor authentication.

Note

Customizing session timeouts helps balance security and usability across your organization.

4. Managing SSH Keys for Git Operations

At the organization level, upload SSH private keys to enable Git-based operations. To generate an RSA key in PEM format:

ssh-keygen -t rsa -m PEM

5. Authenticating with Terraform CLI

On your local machine with Terraform installed, run:

terraform login

This command will open your browser to generate an API token, then return you to the CLI.
The image shows a command-line interface prompting the user to generate and enter a token for Terraform, with instructions to open a web browser to obtain the token.

When prompted, paste your token (input is hidden):

# (Paste your token here)

Terraform will store the credentials for subsequent CLI operations.

6. Interacting with Terraform Cloud via API

First, export your token as an environment variable:

export TERRAFORM_TOKEN="YOUR_TOKEN"

Then request your organization’s details:

curl \
  --header "Authorization: Bearer $TERRAFORM_TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  https://app.terraform.io/api/v2/organizations/Mastering-Terraform-Cloud

A successful response returns your organization’s metadata in JSON:

{
  "data": {
    "id": "Mastering-Terraform-Cloud",
    "type": "organizations",
    "attributes": {
      "external-id": "org-tsVGG3U6yVQPMxxJ",
      "created-at": "2022-08-18T16:34:58.952Z",
      "email": "[email protected]",
      "session-timeout": null,
      "session-remember": null,
      "collaborator-auth-policy": "password",
      "plan-identifier": "free",
      "allow-force-delete-workspaces": true,
      "name": "Mastering-Terraform-Cloud",
      "permissions": {
        "can-update": true,
        "can-destroy": true,
        "can-access-via-teams": true
      }
    }
  }
}

For full API details, see the Terraform Cloud API Reference.

7. Terraform Cloud API Token Types

Terraform Cloud supports these token types:

Token Type	Scope	Use Case
User Token	Individual user permissions	Personal CLI & API access
Team Token	Specific team privileges	Automation with team-level access
Organization Token	Organization-wide management (teams, workspaces)	Scripts managing org resources

The image shows a web interface for managing API tokens in Terraform Cloud, with options to create a new token and a list of existing tokens.
The image shows a webpage from Terraform Cloud's settings, specifically the API Tokens section, detailing user, team, and organization tokens. It includes navigation options on the left and a button to create an organization token.

This concludes our demonstration of web UI, CLI, and API authentication with Terraform Cloud.

The image shows a settings page for authentication in a web application, detailing user session timeout and two-factor authentication options. It includes fields for setting session timeout and reauthentication intervals, with an option to require two-factor authentication for organization members.