DevOps Rich DevOps content for Infrastructure Engineers

Terraform Cloud


Version Control Workflow

Az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/12345686-82de-4a8d-b643-12345605372a"
  "appId": "123456c7-dd48-41c0-aa76-52a770123456",
  "displayName": "azure-cli-2022-01-24-20-13-16",
  "name": "a88530c7-dd48-41c0-aa76-52a770fa69fb",
  "password": "123456.Y1j3j_1234562sxONHwM123456.",
  "tenant": "65123456-faea-4b9d-a488-123456123456"


Workspace - General Settings

Private Module Registry


  1. Create private repository in GitHub.
  2. Upload code including,,, and files.
  3. Create a release for the repository.
  4. TFC > registry - publish a module:
    • Connect to a version control provider -
    • You must register a new OAUTH application in Github under settings> developer settings using the settings provided by TFC.
    • Enter client id, client secret from GitHub into the TFC version control provider configuration.
    • Connect and continue to authorise GitHub access to TFC.
  5. At this point the VCP is configured and you can use the configuration to select a repository that you wish to publish a module from.

Note: In a private module it did not pull in the configuration into the dependency tab.

module "staticwebsiteprivate" {
  source  = ""
  version = "1.0.0"
  # insert required variables here

CLI Driven Workflow

The CLI driven workflow allows you to:

backend "remote" {
    organization = "richbjhudson"
    workspaces {
      name = "cli-driven-azure-demo"
cloud { 
	organization = "richbjhudson" 
		{ name = "cli-driven-azure-demo" }

Migrate State

cloud { 
        organization = "richbjhudson" 
        workspaces { 
          name = "terraformCloudWorkspaceName"
Do you wish to proceed?
  As part of migrating to Terraform Cloud, Terraform can optionally copy your current workspace state to the configured Terraform Cloud workspace.

  Answer "yes" to copy the latest state snapshot to the configured Terraform Cloud workspace.

  Answer "no" to ignore the existing state and just activate the configured Terraform Cloud workspace with its existing state, if any.

  Should Terraform migrate your existing state?

  Enter a value: yes

Note: After this step it creates the workspace if it did not already exist. The workspace is built to use the terraform cli version that you migrated from.

Sentinel Policies

Note: Mandatory policy checks will not pass onto the next stage if they are not compliant. The stage of the check is based on the functions e.g. tfconfig, tfrun, tfplan etc…

Note: You may install the HashiCorp sentinel extension in vscode to make it easier to understand the syntax.


policy "azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period" {
  source = ""
  enforcement_level = "advisory"