Run Terraform in HCP Terraform

terraform {
  cloud {
    organization = "s0sta"
    workspaces {
      name = "shop-prod"
    }
  }
}

$terraform login
$terraform init
$terraform plan

With the CLI-driven workflow, plan and apply still start on your machine but run remotely, with the variables and credentials stored in the workspace.

• Variables and variable sets: Terraform and environment variables, sensitive ones hidden; one set shared by many workspaces.
• Teams and permissions: who may plan, apply, or manage a workspace or project.
• Private registry: share approved modules and providers in the organisation.
• Policy as code (Sentinel or OPA): checks between plan and apply — "no public IPs", "only these VM sizes", "tags required".
• Run tasks: call external tools (security scan, cost check) during a run.
• Drift detection and health checks: find changes made outside Terraform.
• Audit trail: every run, who approved it, and its plan.

• VCS providers: GitHub, GitLab, Azure DevOps, Bitbucket.
• Dynamic provider credentials: OIDC trust between HCP Terraform and Azure/AWS/GCP — no stored cloud keys.
• Notifications: Slack, Teams, email or webhooks on run events.
• **API and the tfe provider**: manage workspaces themselves as code.