Terraform Cloud, now marketed as HCP Terraform, is HashiCorp’s managed platform for running Terraform with remote execution, collaboration, and governance built in. It adds Terraform automation features like workspace-based workflows, policy enforcement, drift detection, private networking via agents, and integrations through run tasks. Over the last decade, infrastructure has shifted from static assets to programmable resources managed as code. Terraform Cloud offers workspaces to maintain different environments for a project and keeps everyone informed in real time.

How Terraform Cloud Works

Terraform Cloud offers workspaces to maintain different environments for a project. This is how using Terraform Cloud works:

• Create Workspaces: A workspace can be formed as an environment or a project. Workspaces apply Terraform configurations and store state within.
• Connect the VCS Repositories: Have plans automatically triggered and applied with a link to your VCS repository.
• Plan and Apply: Terraform Cloud automatically runs terraform plan to present the proposed changes and automatically receives approval before applying (terraform apply).
• Monitor and Manage State: State files are automatically saved and managed and monitored via the workspace, and infrastructures are updated automatically.

The platform abstracts complexity for teams managing hundreds, thousands, or tens of thousands of resources. Provisioning and controlling change across multiple environments are automated by Terraform Cloud.

Core Building Blocks

Workspaces are the building blocks of Terraform Cloud. As you’ve seen before, they are used in the workflows you are defining and they are linked to a specific Terraform configuration. In a nutshell, they are responsible for:

• Storing your state
• Executing Runs – initialization, plans and applies for your configuration code
• Storing Environment Variables – Populate variables in your Terraform configurations

Access control can be defined at the workspace level, giving you the ability to control which users and teams can read/write/administer them.

You can run remote operations against the TFC workspaces as mentioned in the CLI-driven workflow. Even though you are running the commands on your local machine, the workspace will be in charge of doing the heavy lifting.

Projects, in Terraform Cloud, are simply containers for the workspaces. All workspaces belong to a project, and this is useful because you can group them easier. These entities exist to make it easier to assign workspace accesses for the different teams you will have inside your organization.

A run in Terraform Cloud manages the lifecycle of a Terraform operation that is happening against your Workspace.

Workspace Fundamentals in Terraform Cloud

Terraform workspaces let you manage multiple, isolated deployments of the same infrastructure configuration, each with its own state file, without duplicating your code.

If you’ve ever needed to spin up a staging environment that mirrors production, test a config change without touching live infrastructure, or deploy the same setup across multiple AWS accounts or regions, workspaces are the feature that makes that clean and manageable.

What is a Terraform workspace?

Terraform workspaces let you manage multiple deployments of the same configuration. When you create cloud resources using Terraform’s configuration language, they are created in the default workspace. Workspaces are a handy tool for testing configurations, offering flexibility in resource allocation, regional deployments, multi-account deployments, and more.

Terraform stores information about all managed resources in a state file. It is important to store this file in a secure location. Every Terraform run is associated with a state file for validation and reference.

Terraform Cloud workspaces and CLI workspaces share a name but work very differently. CLI workspaces are just multiple state files for the same configuration. Terraform Cloud workspaces are full-featured environments with their own variables, state, run history, access controls, and VCS connections. Understanding these differences and how to use Terraform Cloud workspaces effectively is essential if your team is moving to Terraform Cloud.

CLI Workspaces vs Terraform Cloud Workspaces

Let us clear up the confusion right away:

When you use Terraform Cloud, its workspaces replace CLI workspaces for state isolation. With a single workspace name in the cloud block, you do not use terraform workspace select - instead, that working directory is tied to one Cloud workspace.

Setting Up Terraform Cloud and a Workspace

Here’s a basic example of how you set up your Terraform Cloud account, create a workspace, and deploy infrastructure using Terraform.

1. Create a Terraform Cloud Account

• Step 1: Go to the Terraform Cloud website.
• Step 2: Sign up for a free account or log in if you already have one.
• Step 3: Once logged in, you’ll be prompted to create or join an organization. Create an organization to group related workspaces and projects together.

2. Connect to a Version Control System (VCS)

Terraform Cloud supports integration with popular VCS platforms like GitHub, GitLab, and Bitbucket.

• Step 1: In your Terraform Cloud dashboard, go to "Settings" and select "Version Control."
• Step 2: Connect your preferred VCS provider by granting necessary permissions.
• Step 3: Once connected, you can link a repository that contains your Terraform configuration files.

3. Create a Workspace

A workspace in Terraform Cloud is where your Terraform runs are executed, and state is stored.

• Step 1: In the Terraform Cloud dashboard, navigate to the "Workspaces" tab and click "Create Workspace."
• Step 2: Select a workflow type. The typical choice is the "Version Control" workflow, where Terraform Cloud pulls configuration files from a VCS repository.
• Step 3: Choose the VCS repository that you linked earlier, containing your Terraform configuration files.

Plan, Apply and State Management

After reviewing the plan and approving it, Terraform Cloud will automatically run terraform apply to create the infrastructure specified in your configuration. The status of the apply operation will be visible in the workspace, and you’ll receive notifications (if configured) once the operation completes.

Managing State in Terraform Cloud

• Once the resources are applied, Terraform Cloud will save the state file securely in the cloud.
• This state file is automatically updated every time you make changes to your infrastructure, ensuring that Terraform knows the current state of your resources.

Add Variables to Your Workspace

Terraform configurations often use variables to make code reusable and flexible.

• Step 1: In the Terraform Cloud workspace, navigate to "Variables."
• Step 2: Add environment variables or Terraform variables (such as AWSACCESSKEYID or AWSSECRETACCESSKEY) to securely pass sensitive information.
• Step 3: Terraform Cloud will use these variables during runs to customize the infrastructure deployment based on your needs.

Using Sentinel for Policy Enforcement (Optional)

Terraform Cloud allows you to enforce compliance policies using Sentinel. This is useful for enforcing infrastructure standards.

• Step 1: In your organization settings, go to "Policies" and write a Sentinel policy (e.g., to ensure all S3 buckets are private).
• Step 2: Apply this policy to your workspace

Benefits of Terraform Cloud for Organizations

Scalability

Zero setup allows teams to manage at scale. Hundreds, thousands, or tens of thousands of resources have their complexity abstracted, and provisioning and controlling change across multiple environments are automated by Terraform Cloud.

Security

It offers greater security over the traditional configuration within a local setup in the management of sensitive information, with encryption and controlled access policies through secret management.

Collaboration

It provides a platform of an effective working team in combination with managing the infrastructure.

Terraform Cloud adds Terraform automation features like workspace-based workflows, policy enforcement, drift detection, private networking via agents, and integrations through run tasks. Spacelift is an alternative for orchestrating Terraform/OpenTofu workflows with policy as code, visibility, and governance outside Terraform Cloud.

Practical Patterns and Considerations

Terraform Cloud workspaces and CLI workspaces share a name but work very differently. CLI workspaces are just multiple state files for the same configuration. Terraform Cloud workspaces are full-featured environments with their own variables, state, run history, access controls, and VCS connections.

Workspaces apply Terraform configurations and store state within. Connect the VCS Repositories to have plans automatically triggered and applied with a link to your VCS repository. Terraform Cloud automatically runs terraform plan to present the proposed changes and automatically receives approval before applying (terraform apply).

State files are automatically saved and managed and monitored via the workspace, and infrastructures are updated automatically. Access control can be defined at the workspace level, giving you the ability to control which users and teams can read/write/administer them.

```

Example workspace variable reference in Terraform

variable "environment" {
description = "Target environment name"
type = string
}
```

Conclusion

Terraform Cloud workspaces are not a simple rename of CLI workspaces. They are full-featured environments with their own variables, state, run history, access controls, and VCS connections. CLI workspaces remain useful for local multi-state isolation within a single backend, while Terraform Cloud workspaces replace that pattern with remote execution, isolated state per environment, and team-wide governance.

The building blocks model of Workspaces, Projects, and Runs gives organizations a clear hierarchy for grouping configurations, assigning access, and auditing changes. Workspaces store state, execute runs, and store environment variables with fine-grained RBAC, while Projects containerize workspaces for team management. Runs manage the lifecycle of Terraform operations against a Workspace.

For teams moving from local CLI workflows to Terraform Cloud, the practical shift is to stop using terraform workspace select and instead bind a working directory to a single Cloud workspace via the cloud block. That binding gives you built-in per workspace variables, full audit trails, Slack email and webhook notifications, and policy enforcement through Sentinel. The result is scalability with zero setup for managing tens of thousands of resources, security through encryption and secret management for sensitive variables like AWSACCESSKEYID and AWSSECRETACCESSKEY, and collaboration through a shared platform where plan and apply are visible in real time.

Sources

1. GeeksforGeeks
2. Spacelift What is Terraform Cloud
3. OneUptime
4. Spacelift Terraform Workspaces