8.1.2. CLI Integration and the cloud Block

💡 First Principle: The cloud block connects your local configuration to an HCP Terraform workspace, so you keep using the familiar terraform plan/apply commands locally while execution and state move to the platform — local interface, remote engine.

You integrate the CLI with HCP Terraform using the cloud block inside the terraform block, and authenticate with terraform login (which stores an API token):

terraform {
  cloud {
    organization = "my-org"
    workspaces {
      name = "prod-network"
    }
  }
}

After terraform login and terraform init, commands like plan and apply run remotely in the named workspace. Existing local/remote state can be moved to HCP Terraform via state migration during init. Beyond this CLI-driven workflow, HCP Terraform also supports VCS-driven (runs trigger automatically on repository pushes) and API-driven workflows.

⚠️ Exam Trap: The cloud block (with terraform login for the token) is how the CLI connects to HCP Terraform. Know the three workflows — CLI-driven, VCS-driven, API-driven — and that VCS-driven runs are triggered by commits to a connected repository.

Reflection Question: With a cloud block configured, you run terraform apply on your laptop — where does the apply actually execute, and where does the state live?