HashiCorp Terraform Associate (004) Question 204
Single answer8a Use HCP Terraform to create infrastructureA platform team wants application developers to provision AWS infrastructure through HCP Terraform without installing the AWS CLI or storing long-lived AWS access keys on their laptops. The team also wants every infrastructure change to be tracked in a remote workflow with a plan shown before apply. Which approach best meets these requirements?
- A
Create an HCP Terraform workspace connected to the VCS repository, store AWS credentials as workspace environment variables, and use remote execution so runs occur in HCP Terraform.
- B
Require each developer to run terraform plan and terraform apply locally, then push the generated state file to HCP Terraform after the deployment completes.
- C
Use local execution in the HCP Terraform workspace so plans run on each developer workstation, but configure HCP Terraform to display the results centrally after apply.
- D
Commit AWS access keys into the Terraform configuration as input variables so HCP Terraform can reuse them consistently across workspaces.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use an HCP Terraform workspace with remote execution, typically connected to a version control repository. In this model, Terraform runs in HCP Terraform rather than on a developer laptop, which helps enforce a standard workflow and centralizes run history, plans, applies, and state management. Cloud provider credentials can be stored securely as sensitive workspace environment variables, allowing HCP Terraform to authenticate to AWS during runs without exposing long-lived secrets to developers. This aligns with HCP Terraform best practices for remote operations, workspace variable management, and VCS-driven workflows.
- A. Correct.
Correct. A VCS-connected workspace in HCP Terraform supports a remote workflow where commits trigger runs, HCP Terraform generates and displays the plan, and applies can be controlled centrally. Storing cloud credentials as sensitive environment variables in the workspace keeps them out of developer machines and source control. This is a common and recommended way to use HCP Terraform to create infrastructure.
- B. Incorrect.
Incorrect. This keeps execution on developer machines, which does not satisfy the requirement to avoid installing cloud tooling or handling credentials locally. It also misunderstands HCP Terraform workflows: state is managed remotely by the platform during runs, not by manually pushing a local state file after deployment.
- C. Incorrect.
Incorrect. Local execution means Terraform runs on the user's machine, so developers would still need local tooling and likely local credential access. HCP Terraform's main value here is remote execution with centralized plan/apply tracking, not merely displaying results after a local run.
- D. Incorrect.
Incorrect. Committing AWS access keys into Terraform code is a serious security anti-pattern. Secrets should not be stored in version control or plain input variables in configuration files. HCP Terraform provides secure workspace variables for sensitive values instead.