Terraform Cloud Login and Authentication Workflows

Terraform Cloud login is the interactive mechanism that obtains and stores an API token for Terraform Cloud, Terraform Enterprise, or any other host that offers Terraform services. The workflow is designed for interactive terminal sessions where a web browser can be launched on the same host where Terraform is running. For unattended automation scenarios credentials must be configured manually in the CLI configuration.

Command Overview and Usage

The terraform login command is the entry point for authenticating the CLI to a remote Terraform service.

Usage follows the pattern:

terraform login [hostname]

If you do not provide an explicit hostname, Terraform will assume you want to log in to Terraform Cloud at app.terraform.io. The command obtains an API token for HCP Terraform, Terraform Enterprise, or other host that offers Terraform services.

The command is suitable only for use in interactive scenarios where it is possible to launch a web browser on the same host where Terraform is running. If you are running Terraform in an unattended automation scenario, you can configure credentials manually in the CLI configuration.

Login Server Support

The terraform login command works with any server supporting the login protocol, including Terraform Cloud and Terraform Enterprise. The login protocol support allows the same command to be used against HCP Terraform and Terraform Enterprise.

Interactive Login Workflow for HCP Terraform

The practical workflow for connecting the CLI to HCP Terraform combines organization creation with CLI authentication.

1. Create organization
2. Log into your HCP Terraform account with the Terraform CLI by running terraform login in your terminal.

Example session:

$ terraform login Terraform will request an API token for app.terraform.io using your browser.

The CLI explains specifically where it intends to save the API token and gives you a chance to cancel if the current configuration is not as desired.

After you respond yes to the confirmation prompt, Terraform will open a browser window to allow you to create an API token.

Enter a value: yes

Terraform must now open a web browser to the tokens page for app.terraform.io.
If a browser does not open this automatically, open the following URL to proceed:

https://app.terraform.io/app/settings/tokens?source=terraform-login

Generate a token using your browser, and copy-paste it into this prompt. Terraform will not print your token to the screen when you paste it.

Token for app.terraform.io:
Enter a value:

Follow the workflow in your browser to generate an API token. Then, paste the API token into your terminal when Terraform prompts you to do so.

On successful authentication the CLI reports:

```

Retrieved token for user YOU

-

Welcome to HCP Terraform! - ---------- -------

Documentation: terraform.io/docs/cloud -------- -

----------

-
```

The token is stored in plain text in the following file for use by subsequent commands:

/Users/YOU/.terraform.d/credentials.tfrc.json

Do you want to proceed?
Only 'yes' will be accepted to confirm.

Respond to the confirmation prompt with yes and Terraform will open a browser window to allow you to create an API token.

Connecting a Workspace to HCP Terraform

After authentication, HCP Terraform also supports grouping your workspaces into projects to more easily manage their access and settings.

Update the terraform block in terraform.tf to add a cloud block that connects your local workspace to HCP Terraform.

terraform.tf terraform { cloud { organization = "your-organization-name" workspaces { project = "Learn Terraform" name = "learn-terraform-aws-get-started" } } required_providers { aws = { source = "hashicorp/aws" version = "~> 5.92" } } required_version = ">= 1.2.0" }

Replace your-organization-name with your organization name, which you can find in the HCP Terraform portal.

Now that you have configured your HCP Terraform integration, run terraform init to re-initialize your configuration and copy your state to HCP Terraform.

$ terraform init Initializing HCP Terraform... Do you wish to proceed?

As part of migrating to HCP Terraform, Terraform can optionally copy your current workspace state to the configured HCP Terraform workspace.

Answer "yes" to copy the latest state snapshot to the configured HCP Terraform workspace.
Answer "no" to ignore the existing state and just activate the configured HCP Terraform workspace with its existing state, if any.

Should Terraform migrate your existing state? Enter a value: yes Initializing modules... Initializing provider plugins... - Reusing previous version of hashicorp/aws from the dependency lock file - Using previously-installed

Credentials Storage Behavior

By default, Terraform will obtain an API token and save it in plain text in a local CLI configuration file called credentials.tfrc.json. When you run terraform login, it will explain specifically where it intends to save the API token and give you a chance to cancel if the current configuration is not as desired.

If you do not wish to store your API token in the default location, you can optionally configure a credentials helper program which knows how to store and later retrieve credentials in some other system, such as your organization's existing secrets management system.

You can optionally configure a credentials helper program that knows how to store and later retrieve credentials in some other system, such as your organization's existing secrets management system.

Table 1 summarizes credential storage characteristics.

Authentication When Using Terraform with Google Cloud

This document describes how to authenticate to Google Cloud when using Terraform. Application Default Credentials (ADC) is the recommended way to authenticate to Google Cloud when using Terraform.

ADC is a strategy used by the authentication libraries to automatically find credentials based on the application environment. When you use ADC, Terraform can run in either a development or production environment without changing how it authenticates to Google Cloud services and APIs. For information about where ADC looks for credentials and in what order, see How Application Default Credentials works.

Authenticate when using Terraform in a local development environment

Authenticate using a user account

To configure ADC with a user account, you use the Google Cloud CLI:

-
gcloud init

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

-
If you're using a local shell, then create local authentication credentials for your user account:
gcloud auth application-default login

You don't need to do this if you're using Cloud Shell.

If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

A sign-in screen appears

After you sign in, your credentials are stored in the local credential file used by ADC.

Authenticate using service account impersonation

You can use service account impersonation to set up a local ADC file. Terraform uses those credentials automatically.

Make sure you must have the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) IAM role on the service account you are impersonating. For more information, see Required roles.

Use service account impersonation to create a local ADC file by running the following command:

gcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL

If you want to allow users to use a shared primary authentication source and a variable service account per environment, set the impersonateserviceaccount field in your Terraform configuration file:

provider "google" { impersonate_service_account = "SERVICE_ACCT_EMAIL" }

Authenticate when running Terraform on Google Cloud

When running Terraform on a Google Cloud cloud-based development environment such as Cloud Shell, the tool uses the credentials you provided when you signed in for authentication.

When using Terraform with Google Cloud services such as Compute Engine, App Engine, and Cloud Run functions, you can attach a user-managed service account to resources. Generally, attaching a service account is supported when that service's resources can run or include application code

Operational Notes

• The terraform login command obtains an API token for HCP Terraform, Terraform Enterprise, or other host that offers Terraform services.
• You can only use this command in interactive scenarios because the command launches a web browser on the same host where Terraform is running.
• If you are running Terraform in an unattended automation scenario, you can configure credentials manually in the CLI configuration.
• By default, Terraform will obtain an API token and save it in plain text in a local CLI configuration file called credentials.tfrc.json.
• When you run terraform login, it will explain specifically where it intends to save the API token and give you a chance to cancel if the current configuration is not as desired.

Table 2 compares login targets.

Conclusion

Terraform Cloud login provides a standardized interactive method to obtain an API token and persist it for subsequent CLI operations. The terraform login command launches a browser-based token creation flow, confirms storage location, and writes credentials to credentials.tfrc.json in plain text by default, with the option to redirect storage via a credentials helper. The workflow is supported for Terraform Cloud, HCP Terraform, and Terraform Enterprise via the login protocol, and requires an interactive session with browser access. For Google Cloud workloads, authentication is decoupled from Terraform Cloud login and relies on Application Default Credentials configured through gcloud init and gcloud auth application-default login, including optional service account impersonation via impersonate_service-account flag or provider block field. Understanding the storage path, confirmation prompts, and the distinction between interactive login and manual credential configuration is essential for secure and reliable Terraform operations in both development and production environments.

Sources

1. Terraform Login DevNet Docs
2. HashiCorp Terraform CLI Login
3. HashiCorp AWS HCP Terraform Tutorial
4. Google Cloud Terraform Authentication