HashiCorp Terraform Associate (004) Question 222
Single answer8d Configure and use HCP Terraform integrationA platform team is migrating from local Terraform execution to HCP Terraform. They want all plans and applies to run remotely in a single HCP Terraform workspace, while developers continue to use the Terraform CLI from their laptops. The team also wants to stop storing cloud provider credentials in local environment variables on developer machines. Which action should they take to meet these requirements with the least operational overhead?
- A
Add a cloud block to the Terraform configuration that targets the HCP Terraform organization and workspace, and configure the cloud provider credentials as workspace environment variables in HCP Terraform.
- B
Keep using the default local backend, run terraform login only on each developer laptop, and store the cloud provider credentials in each developer's ~/.terraformrc file.
- C
Configure an http backend that points to HCP Terraform, and commit the cloud provider credentials to terraform.tfvars so remote runs can access them.
- D
Use a local backend with Terraform Cloud agents installed on each developer laptop, and pass provider credentials through -var flags during terraform apply.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the Terraform cloud block to connect the configuration to HCP Terraform and let plans/applies run remotely in the target workspace. In this model, developers can still use the Terraform CLI, but execution happens in HCP Terraform rather than on local machines. The CLI can authenticate to HCP Terraform with terraform login, while cloud provider credentials should be configured in the HCP Terraform workspace as sensitive environment variables or through supported dynamic credentials integrations. This approach reduces credential sprawl, centralizes execution, and aligns with HashiCorp-recommended CLI-driven remote workflow practices for HCP Terraform.
- A. Correct.
Correct. Using a cloud block integrates the CLI workflow with HCP Terraform so operations execute remotely in the specified organization and workspace. Storing cloud provider credentials as sensitive environment variables in the HCP Terraform workspace keeps them off developer laptops and centralizes run-time authentication. This is the standard approach for remote operations with HCP Terraform.
- B. Incorrect.
Incorrect. terraform login authenticates the CLI to HCP Terraform, but it does not solve the requirement for remote runs to access cloud provider credentials centrally. Storing provider credentials in each developer's ~/.terraformrc is not how provider authentication is typically managed and would still leave credentials distributed across laptops.
- C. Incorrect.
Incorrect. HCP Terraform is not configured by pointing a generic http backend at it for normal workspace-based remote operations. Also, committing cloud credentials to terraform.tfvars is insecure and contrary to best practices because variable files are often stored in version control or shared locally.
- D. Incorrect.
Incorrect. Terraform Cloud agents are used to execute runs from HCP Terraform in self-managed environments when needed, not as something installed on every developer laptop for a local backend workflow. Passing provider credentials via -var flags is also a poor practice because provider credentials should generally be supplied through secure environment variables or dynamic credentials mechanisms, not exposed in CLI history or shell processes.