Skip to main content
Connect HCP Terraform to CloudThinker to inventory workspaces, review recent run status, and make approved workspace changes. This connection uses an organization token for one HCP Terraform organization.

​
Prerequisites

  • An HCP Terraform organization containing the workspaces you want to inspect.
  • The organization name shown in HCP Terraform.
  • An organization owner who can create or revoke the organization’s API token.
An organization token has authority across its HCP Terraform organization. CloudThinker limits its own actions to the capabilities on this page, but you should still treat the token as an organization-wide secret.

​
Setup

1

Select your HCP Terraform organization

Sign in to HCP Terraform, then select the organization you want to connect from the sidebar. Copy its organization name.
2

Create an organization token

Open Organization settings → API Token. Under Organization Tokens, use the displayed controls to generate the organization token, then copy it immediately.Only organization owners can generate or revoke this single organization-wide token. Before creating or rotating it, coordinate with the organization owners and any existing automations that use it.
3

Add the connection in CloudThinker

Navigate to Connections → HCP Terraform and enter:
  • Organization name: the name of the organization you selected
  • Organization token: the token you just created
Click Connect. CloudThinker verifies the organization and shows a Connected status.
HCP Terraform displays a token only when you create it. Store it securely before leaving the page. Creating or revoking the organization’s token can affect other automations that use it.

​
Connection details

​
Required permissions

Use this organization’s single organization token, not a personal or team token. Only an organization owner can generate or revoke it. HCP Terraform organization tokens can manage organization-level resources but cannot start runs or create configuration versions.
Use the existing organization token when the organization already has one. Before creating or rotating it, coordinate with the organization owners and existing automations. The token has organization-wide authority even though CloudThinker exposes only the bounded workspace actions below.

​
Agent capabilities

Workspace inventory and recent run status are read-only. Before creating, renaming, locking, unlocking, or safely deleting a workspace, CloudThinker asks for a separate visible approval for that action.

​
Limits

This connection cannot start plans, applies, or runs. It cannot upload or download configuration or state, change variables, show sensitive outputs, force unlock or force delete a workspace, delete an organization, administer teams or tokens, or connect to Terraform Enterprise custom endpoints.

​
Verify the connection

​
Example prompts

​
Troubleshooting

Enter the organization name shown in HCP Terraform. Do not paste the organization URL or an HCP organization ID.
Create a replacement organization token if the current one is expired or no longer valid, then update Organization token and reconnect.
Check that Organization name and Organization token belong to the same HCP Terraform organization, then reconnect.
The token belongs to a different organization than the one entered in Organization name. Enter the matching organization name or use that organization’s token.
Wait and reconnect later. Do not repeatedly retry the connection while HCP Terraform is rate limiting requests.
HCP Terraform could not complete the verification. Retry later; the connection does not treat this as a successful result.
For safe deletion, this can mean the workspace still manages resources. CloudThinker does not force-delete it. Keep the workspace until it is empty, and unlock it before an allowed workspace change if needed.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Set and track expiration — HCP Terraform tokens expire, and you cannot change an expiration after creation. Choose the shortest duration your policy permits and replace the token before it expires.
  • Coordinate rotation — only one organization token is valid at a time. Confirm which integrations use it before you generate or revoke a token.

Approval

Review how CloudThinker asks before a workspace change.

Pulumi Connection

Connect another infrastructure-management service.