HashiCorp Terraform Associate (004) Question 213
Select 38b Describe HCP Terraform collaboration and governance featuresA platform team uses HCP Terraform to manage infrastructure for several application teams. They want developers to be able to propose infrastructure changes through version control, but they must prevent direct applies to production unless the changes pass policy checks and are explicitly approved by an operations lead. Which HCP Terraform features should they use to meet these collaboration and governance requirements?
- A
Connect the workspace to a VCS repository, use speculative plans for pull requests, and require apply permissions only for a limited set of users or teams
- B
Use Sentinel policy sets to enforce governance checks before applies are allowed
- C
Configure local execution mode so developers can run terraform apply from their laptops after opening a pull request
- D
Use run tasks to integrate external checks into the run workflow before apply
- E
Store the Terraform state file in each developer's local working directory so operations can review it before merge
Show answer and explanation
Correct answers: A, B, D
Explanation
The best answer combines HCP Terraform collaboration features with governance controls. VCS-driven workflows and speculative plans support team collaboration by allowing infrastructure changes to be reviewed through pull requests before execution. Role-based access control can limit who is allowed to apply to sensitive workspaces such as production. For governance, Sentinel policy sets provide policy-as-code enforcement, and run tasks can integrate external security or compliance systems into the run workflow. Together, these features help organizations implement separation of duties, centralized review, and controlled production changes. These are established HCP Terraform capabilities documented in HashiCorp guidance around VCS workflows, team and permission management, policy sets with Sentinel, and run tasks.
- A. Correct.
Correct. In HCP Terraform, connecting a workspace to a VCS repository enables VCS-driven workflows where changes are proposed through commits and pull requests. Speculative plans let teams review the impact of proposed changes without applying them. Restricting apply permissions to specific users or teams supports separation of duties so developers can collaborate on changes without directly applying to production.
- B. Correct.
Correct. Sentinel policy sets are an HCP Terraform governance feature used to enforce policy-as-code. They can evaluate runs and block applies when infrastructure changes violate organizational rules. This directly supports the requirement that changes must pass policy checks before production applies are allowed.
- C. Incorrect.
Incorrect. Local execution from developer laptops bypasses key HCP Terraform collaboration and governance controls. It does not provide the same centralized approval, audit, and policy enforcement workflow expected for controlled production changes. The scenario specifically requires preventing direct applies to production by general developers, not enabling them.
- D. Correct.
Correct. Run tasks let HCP Terraform call external systems during the run lifecycle, commonly for security, compliance, or operational validation. They complement governance workflows by adding checks before apply. This is a valid collaboration/governance feature when an organization needs additional approval or validation gates beyond core Terraform planning and policy checks.
- E. Incorrect.
Incorrect. Keeping state locally undermines HCP Terraform's remote state management, collaboration, locking, and auditability capabilities. HCP Terraform is designed to centralize state and runs so teams can collaborate safely. Local state files do not meet the stated governance requirements.