HashiCorp Terraform Associate (004) Question 220
Single answer8d Configure and use HCP Terraform integrationA team currently runs Terraform locally against AWS, but they want HCP Terraform to execute plans and applies remotely and to automatically trigger a run whenever code is pushed to their VCS repository. They also want to keep using their existing AWS provider configuration without hardcoding cloud credentials in the Terraform code. Which configuration change is the best way to meet these requirements?
- A
Add a cloud block to the Terraform configuration that points to the HCP Terraform organization and workspace, connect the workspace to the VCS repository in HCP Terraform, and store AWS credentials as workspace environment variables.
- B
Replace the backend block with a local backend, configure terraform apply to run from a CI server, and commit AWS access keys to terraform.tfvars so HCP Terraform can read them.
- C
Configure an http backend in Terraform, point it to the VCS repository URL, and define AWS credentials in provider blocks so HCP Terraform can inherit them during remote execution.
- D
Use terraform login on each engineer's laptop, keep runs local, and rely on the HCP Terraform UI only for viewing state after manually uploading state files.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the Terraform cloud integration via the cloud block, map the configuration to an HCP Terraform workspace, and then connect that workspace to the team's version control repository. In this model, HCP Terraform performs remote plans and applies and can automatically queue runs when VCS changes are detected. Cloud provider credentials should be supplied securely through workspace environment variables, variable sets, or supported dynamic credential integrations rather than embedded in code. This aligns with HashiCorp best practices for HCP Terraform remote execution, VCS-driven workflows, and sensitive data handling.
- A. Correct.
Correct. A cloud block configures the Terraform CLI to use HCP Terraform for remote operations with a specific organization and workspace mapping. To trigger runs from code changes, the HCP Terraform workspace should be connected to the VCS repository. For secure authentication to AWS during remote execution, best practice is to set credentials as environment variables or use dynamic credentials supported by HCP Terraform integrations, rather than hardcoding them in configuration files.
- B. Incorrect.
Incorrect. A local backend does not enable HCP Terraform remote execution. Running Terraform from a separate CI system can be valid in some workflows, but it does not satisfy the requirement to use HCP Terraform as the execution platform. Committing AWS access keys to terraform.tfvars is also a serious security anti-pattern because secrets should not be stored in version control.
- C. Incorrect.
Incorrect. An http backend stores state in a generic HTTP endpoint; it does not connect Terraform execution to VCS-driven runs in HCP Terraform. Pointing a backend to a VCS repository URL is not how Terraform or HCP Terraform works. Also, putting AWS credentials directly in provider blocks is discouraged and does not align with secure HCP Terraform remote execution practices.
- D. Incorrect.
Incorrect. terraform login only authenticates the CLI to HCP Terraform or Terraform Enterprise for API access. It does not by itself configure remote execution or VCS-triggered runs. Keeping runs local also fails the requirement that plans and applies occur in HCP Terraform, and manually uploading state is not the standard integration workflow.