8.1.2. CLI Integration and the cloud Block

💡 First Principle: The cloud block connects your local configuration to an HCP Terraform workspace, so you keep using the familiar terraform plan/apply commands locally while execution and state move to the platform — local interface, remote engine.

You integrate the CLI with HCP Terraform using the cloud block inside the terraform block, and authenticate with terraform login (which obtains an API token and saves it in a local CLI credentials file, credentials.tfrc.json — not in your configuration):

terraform {
  cloud {
    organization = "my-org"
    workspaces {
      name = "prod-network"
    }
  }
}

After terraform login and terraform init, commands like plan and apply run remotely in the named workspace. Existing local/remote state can be moved to HCP Terraform via state migration during init. Beyond this CLI-driven workflow, HCP Terraform also supports VCS-driven (runs trigger automatically on repository pushes) and API-driven workflows.

⚠️ Exam Trap: The cloud block (with terraform login for the token) is how the CLI connects to HCP Terraform. Know the three workflows — CLI-driven, VCS-driven, API-driven — and that VCS-driven runs are triggered by commits to a connected repository.

Reflection Question: With a cloud block configured, you run terraform apply on your laptop — where does the apply actually execute, and where does the state live?