Terraform Cloud Workspaces

Terraform Cloud Workspaces are the core organizational units within Terraform Cloud. They let you isolate, manage, and collaborate on collections of infrastructure—each with its own state, variables, and run history.

A workspace bundles everything Terraform needs to manage a specific environment or component in your Terraform Cloud organization:

Key features include:

• Linked Version Control System (VCS) repository for configuration
• Workspace-level variables (plaintext and sensitive)
• Remote, managed state storage
• Historical run logs, cost estimation, governance, and notifications

Table of Contents

1. Key Components
2. Units of Isolation
3. Real-World Example: Airline Corporation
4. Reducing the Blast Radius
5. Naming Conventions
6. Workspace Settings
7. Execution Modes
8. Getting Started
9. References

Key Components of a Workspace

Units of Isolation

Workspaces act as isolated directories, each maintaining its own state. This decomposition reduces risk by preventing unintended cross-environment changes:

Typical decomposition:

• App → Dedicated workspace
• Network → Shared workspace
• Database → Separate workspace

Real-World Example: Airline Corporation

An airline might organize by application tier and environment:

Possible workspace layout:

Reducing the Blast Radius

Combining multiple environments in one state file risks cross-environment side effects. By isolating Dev, QA, and Prod in separate workspaces, changes in QA can never impact Prod:

With dedicated qa and prod workspaces:

Naming Conventions

Consistent workspace names simplify filtering, access control, and governance. Include:

• Application or component
• Environment (e.g., dev, qa, prod)
• Region or cloud provider
• Team or project prefix

Examples:

Workspace Settings

Each workspace offers granular settings:

• Terraform version selection
• Run history, logs, and cost estimates
• Role-based access control (RBAC)
• Notifications (email, Slack, webhook)
• Governance & policy checks via Sentinel or OPA

Execution Modes

Terraform Cloud supports two modes for running operations:

Local Execution

Run Terraform commands on your workstation, but store state remotely in Terraform Cloud. Ideal for minimal workflow changes:

Remote Execution

All operations execute within Terraform Cloud’s infrastructure, centralizing runs, logs, and policies:

Getting Started with Terraform Cloud

Add a backend or cloud block in your terraform configuration, then initialize:

# Terraform 1.0 and Earlier
terraform {
  backend "remote" {
    hostname     = "app.terraform.io"
    organization = "my-organization"
    workspaces {
      name = "my-workspace"
    }
  }
}


# Terraform 1.1 and Later
terraform {
  cloud {
    hostname     = "app.terraform.io"
    organization = "my-organization"
    workspaces {
      name = "my-workspace"
    }
  }
}

Run:

terraform init

This configures Terraform Cloud for state storage and workspace management.

By leveraging Terraform Cloud Workspaces, you can clearly separate environments, enforce policy and governance, and scale collaborations across teams. Choose a naming convention, select the execution mode that fits your workflow, and get full visibility into your infrastructure changes.

References

• Terraform Cloud Documentation
• Remote State in Terraform
• Terraform Sentinel Policies