Terraform Cloud Workflows

Overview

Terraform Cloud extends your typical Terraform process—write configurations, run terraform plan, and execute terraform apply—by centralizing state, history, and team collaboration. Whether you’re kicking off runs manually, triggering them on Git commits, or embedding Terraform in CI/CD pipelines, Terraform Cloud adapts to your needs.

Terraform Cloud offers three main workflows to fit different team models:

Depending on how mature your processes are, you can:

• Queue runs on demand (manual).
• Push code to version control and apply manually (semi-automated).
• Deploy infrastructure on every commit (continuous).

When you create a workspace, Terraform Cloud prompts you to select a workflow: Command Line (CLI), Version Control (VCS), or API.

1. CLI Workflow

The CLI Workflow is the default experience in Terraform Cloud and closely parallels open-source Terraform. You author and plan locally, but state and run history live in Terraform Cloud.

Typical local steps:

terraform init
terraform plan
terraform apply

With the CLI workflow:

• State is stored remotely in Terraform Cloud.
• Runs can execute locally or in Terraform Cloud, based on workspace settings.
• You retain familiar CLI commands.

To connect your local CLI to Terraform Cloud, add a terraform block in your configuration:

terraform {
  cloud {
    hostname     = "app.terraform.io"
    organization = "my-organization"
    workspaces {
      name = "bagapp-web-aws-prod"
    }
  }
}

This configuration tells Terraform where to store state and which workspace to target.

2. Version Control Workflow

The Version Control Workflow (VCS) integrates Terraform Cloud directly with Git platforms (GitHub, GitLab, Bitbucket, Azure DevOps). Each commit or pull request can automatically trigger plans and, optionally, applies.

Key features:

• Automated terraform plan on commits or pull requests.
• Speculative runs for pre-merge previews.
• Manual or automatic terraform apply after approval.
• Branch-to-workspace mapping for different environments.

Supported VCS providers:

• GitHub
• GitLab
• Bitbucket
• Azure DevOps

For private Git servers, configure SSH keys under your workspace settings.

When you push to the connected branch, Terraform Cloud will:

1. Detect the commit.
2. Run terraform plan.
3. Pause for manual approval (if auto-apply is off).
4. Execute terraform apply (if approved) and stream results back to both the UI and your Git platform.

You can still run speculative plans locally:

terraform plan

But all applies happen through commits, ensuring your infrastructure matches version-controlled code.

Branching Strategy Example

Here’s one common mapping of Git branches to Terraform Cloud workspaces:

3. API Workflow

The API Workflow is the most flexible. It’s perfect for teams embedding Terraform in CI/CD pipelines, internal dashboards, or custom tools. You create runs via Terraform Cloud’s REST API, giving you full programmatic control.

With the API workflow you will:

1. Package Terraform configurations (as a ZIP or VCS module).
2. Authenticate with an API token.
3. Call Terraform Cloud’s Runs API to create and monitor plans/applies.
4. Implement custom logic for error handling and approvals.

Use official client libraries (Go, Python, Ruby, .NET) or direct HTTP requests to integrate tightly with your existing toolchain.

Summary

Terraform Cloud provides three workflows to suit your team’s collaboration style:

Each workspace in Terraform Cloud can be configured for one of these workflows—and you can switch workflows as your processes evolve.