Terraform block reference

This topic provides reference information about the terraform block. The terraform block allows you to configure Terraform behavior, including the Terraform version, backend, integration with HCP Terraform, and required providers.

Configuration model

The following list outlines attribute hierarchy, data types, and requirements in the terraform block. Click on an attribute for details.

• terraform
  • required_version: string
  • required_providers: map
  • provider_meta "<LABEL>": map
  • backend "<BACKEND_TYPE>": map
  • cloud: map
    • organization: string | required when connecting to HCP Terraform
    • workspaces: map | required when connecting to HCP Terraform
      • tags: list of strings or map of strings
      • name: string
      • project: string
    • hostname: string | app.terraform.io
    • token: string
  • experiments: list of strings

Specification

This section provides details about the fields you can configure in the terraform block. Specific providers and backends may support additional fields.

terraform

Parent block that contains configurations that define Terraform behavior. You can only use constant values in the terraform block. Arguments in the terraform block cannot refer to named objects, such as resources and input variables. Additionally, you cannot use built-in Terraform language functions in the block.

terraform{}.required_version

Specifies which version of the Terraform CLI is allowed to run the configuration. Refer to Version constraints for details about the supported syntax for specifying version constraints.

Use Terraform version constraints in a collaborative environment to ensure that everyone is using a specific Terraform version, or using at least a minimum Terraform version that has behavior expected by the configuration.

Terraform prints an error and exits without taking actions when you use a version of Terraform that does not meet the version constraints to run the configuration.

Modules associated with a configuration may also specify version constraints. You must use a Terraform version that satisfies all version constraints associated with the configuration, including constraints defined in modules, to perform operations. Refer to Modules for additional information about Terraform modules.

The required_version configuration applies only to the version of Terraform CLI and not versions of provider plugins. Refer to Provider Requirements for additional information.

• Data type: String
• Default: Latest version of Terraform

terraform{}.required_providers

Specifies all provider plugins required to create and manage resources specified in the configuration. Each local provider name maps to a source address and a version constraint. Refer to each Terraform provider’s documentation in the public Terraform Registry, or your private registry, for instructions on how to configure attributes in the required_providers block.

• Data type: Map

terraform{}.provider_meta "<LABEL>"

Specifies metadata fields that a provider may expect. Individual modules can populate the metadata fields independently of any provider configuration. Refer to Provider Metadata for additional information.

• Data type: Map

terraform{}.backend "<BACKEND_TYPE>"

Specifies a mechanism for storing Terraform state files. The backend block takes a backend type as an argument. Refer to Backend Configuration for details about configuring the backend block.

You cannot configure a backend block when the configuration also contains a cloud configuration for storing state data.

• Data type: Map

terraform{}.cloud

Specifies a set of attributes that allow the Terraform configuration to connect to either HCP Terraform or a Terraform Enterprise installation. HCP Terraform and Terraform Enterprise provide state storage, remote execution, and other benefits. Refer to the HCP Terraform and Terraform Enterprise documentation for additional information.

You can only provide one cloud block per configuration.

You cannot configure a cloud block when the configuration also contains a backend configuration for storing state data.

The cloud block cannot refer to named values, such as input variables, locals, or data source attributes.

• Data type: Map

terraform{}.cloud{}.organization

Specifies the name of the organization you want to connect to. Instead of hardcoding the organization as a string, you can alternatively use the TF_CLOUD_ORGANIZATION environment variable.

• Data type: String
• Required when connecting to HCP Terraform

terraform{}.cloud{}.workspaces

Specifies metadata for matching workspaces in HCP Terraform. Terraform associates the configuration with workspaces managed in HCP Terraform that match the specified tags, name, or project. You can specify the following metadata in the workspaces block:

• Data type: Map
• Required when connecting to HCP Terraform

terraform{}.cloud{}.hostname

Specifies the hostname for a Terraform Enterprise deployment. Instead of hardcoding the hostname of the Terraform Enterprise deployment, you can alternatively use the TF_CLOUD_HOSTNAME environment variable.

• Data type: String
• Required when connecting to Terraform Enterprise
• Default: app.terraform.io

terraform{}.cloud{}.token

Specifies a token for authenticating with HCP Terraform. We recommend omitting the token from the configuration and either using the terraform login command or manually configuring credentials in the CLI configuration file instead.

• Data type: String

terraform{}.experiments

Specifies a list of experimental feature names that you want to opt into. In releases where experimental features are available, you can enable them on a per-module basis.

Experiments are subject to arbitrary changes in later releases and, depending on the outcome of the experiment, may change significantly before final release or may not be released in stable form at all. Breaking changes may appear in minor and patch releases. We do not recommend using experimental features in Terraform modules intended for production.

Modules with experiments enabled generate a warning on every terraform plan or terraform apply operation. If you want to try experimental features in a shared module, we recommend enabling the experiment only in alpha or beta releases of the module.

Refer to the Terraform changelog for information about experiments and to monitor the release notes about experiment keywords that may be available.

• Data type: List of strings

Environment variables for the cloud block

You can use environment variables to configure one or more cloud block attributes. This is helpful when you want to use the same Terraform configuration in different HCP Terraform organizations and projects. Terraform only uses these variables if you do not define corresponding attributes in your configuration. If you choose to configure the cloud block entirely through environment variables, you must still add an empty cloud block in your configuration file.

Use the following environment variables to configure the cloud block:

• TF_CLOUD_ORGANIZATION - The name of the organization. Terraform reads this variable when organization is omitted from the cloud block`. If both are specified, the configuration takes precedence.

• TF_CLOUD_HOSTNAME - The hostname of a Terraform Enterprise installation. Terraform reads this when hostname is omitted from the cloud block. If both are specified, the configuration takes precedence.

• TF_CLOUD_PROJECT - The name of an HCP Terraform project. Terraform reads this when workspaces.project is omitted from the cloud block. If both are specified, the cloud block configuration takes precedence.

• TF_WORKSPACE - The name of a single HCP Terraform workspace. Terraform reads this when workspaces is omitted from the cloud block. HCP Terraform will not create a new workspace from this variable; the workspace must exist in the specified organization. You can set TF_WORKSPACE if the cloud block uses tags. However, the value of TF_WORKSPACE must be included in the set of tags. This variable also selects the workspace in your local environment. Refer to TF_WORKSPACE for details.

Examples

The following examples demonstrate common configuration patterns for specific use cases.

Add a provider

The following configuration requires the aws provider version 2.7.0 or later from the public Terraform registry:

terraform {
  required_providers {
    aws = {
      version = ">= 2.7.0"
      source = "hashicorp/aws"
    }
  }
}

Connect to HCP Terraform

In the following example, the configuration links the working directory to workspaces in the example_corp organization that contain the layer=app tag:

terraform {
  cloud {
    organization = "example_corp"
    workspaces {
      tags = {
        layer = "app"
      }
    }
  }
}

Connect to Terraform Enterprise

In the following example, the configuration links the working directory to workspaces in the example_corp organization that contain the app key-only tag. Key-only tags must be used with versions of Terraform Enterprise prior to v202411-1 or versions of Terraform prior to v1.10. The hostname field is required in the configuration unless you use the TF_CLOUD_HOSTNAME environment variable:

terraform {
  cloud {
    organization = "example_corp"
    hostname = "my.terraform-enterprise.host"
    workspaces {
      tags = ["app"]
    }
  }
}

Connect to Terraform Enterprise using environment variables

In the following example, Terraform checks the TF_CLOUD_ORGANIZATION and TF_CLOUD_HOSTNAME environment variables and automatically populates the organization and hostname arguments. During initialization, the local Terraform CLI connects the working directory to Terraform Enterprise using those values. As a result, Terraform links the configuration to either HCP Terraform or Terraform Enterprise and allows teams to reuse the configuration in different continuous integration pipelines:

terraform {
  cloud {
    workspaces {
      tags = ["app"]
    }
  }
}