Collaborative Workflows practice questions

In a .tfvars file

Why it fails: tfvars files are plain text and insecure for secrets.

In a version-controlled .env file

Why it fails: Version control is insecure for secrets.

In the state file

Why it fails: State files contain secrets in plain text and are not a secure storage mechanism.

Global settings

Why it fails: Global settings control organisation-wide options such as cost estimation and sentinel policies, not workspace creation permissions. It tempts because the name suggests organisation-wide control, but the workspace creation permission sits under the organisation's Workspace settings, where the default and team-level create rights are configured.

Agent pool settings

Why it fails: Agent pool settings govern which agents execute runs and their scope, not who may create workspaces. It tempts because agent pools are organisation-level and access-controlled, but they manage run execution infrastructure rather than workspace creation permissions, which live in the organisation's Workspace settings.

Workspace settings

Why it fails: This is per-workspace, not organization-wide.

Run trigger

Why it fails: Run triggers execute Sentinel policy checks at plan, apply, or import time; they schedule evaluation but hold no rule logic defining permitted VM sizes. It is tempting because triggers gate deployments, yet the enforcement content itself lives in policy definitions, which is where size restrictions are declared.

Workspaces

Why it fails: Workspaces group Sentinel policies, policy sets, and runs into isolated environments; they provide scoping and separation rather than the rule content that restricts VM sizes. It is tempting because workspaces organise governance, but the actual size constraint must be expressed inside a policy, not a workspace container.

Policy Set

Why it fails: Policy sets bundle multiple Sentinel policies for attachment to workspaces or run triggers; they aggregate existing rules rather than define the VM size condition itself. It is tempting because policy sets drive enforcement scope, yet the specific allowed-size logic must first exist within an individual policy before any set can include it.

It blocks the run completely

Why it fails: Soft-mandatory permits an authorised user to override a failed policy and proceed, so it does not block the run completely; hard-mandatory does that. It tempts because both levels stop the run initially, but soft-mandatory exists precisely to allow a privileged override.

It is a deprecated feature

Why it fails: It is a supported feature.

It only logs the event

Why it fails: Soft-mandatory halts the run and requires an authorised user to override the failure; advisory is the level that only logs without blocking. It tempts because both produce log entries, but soft-mandatory gates the run pending an override decision.

gRPC

Why it fails: gRPC is used for provider plugins, not the cloud platform communication.

FTP

Why it fails: FTP is not used.

SSH

Why it fails: SSH is for code repo access, not Terraform communication.

Shared modules

Why it fails: Shared modules distribute reusable configuration across workspaces, but they carry no credentials or account mapping, so they cannot target separate cloud accounts. They are the right answer when standardising identical resource definitions across many teams, not when one organisation must reach multiple accounts.

Provider aliases

Why it fails: Provider aliases let a single configuration address several regions or accounts within one workspace, but they do not give organisation-level management across separate cloud accounts. They are correct when one root module must deploy into two regions or two accounts simultaneously.

Remote execution

Why it fails: Remote execution runs Terraform operations on HCP Terraform's runners instead of locally, which changes where plans and applies happen, not which cloud accounts the organisation can manage. It is the right choice when you need consistent, networked agent execution rather than multi-account governance.

Delete the repository

Why it fails: Deleting the repository destroys history and collaboration but leaves the secret in your local working directory, shell history and any clones; the workspace still holds the credential. Repository deletion suits abandoning a compromised project entirely, not remediating a leaked value that must be purged from state and re-referenced.

Disable VCS integration

Why it fails: Disabling VCS integration stops future commits syncing but does nothing to the secret already present in the workspace's variables, state or local files, so runs can still consume it. VCS integration is disabled when you want to drive runs solely via the CLI or API instead of webhooks.

Run terraform destroy

Why it fails: terraform destroy removes managed infrastructure but leaves the secret in configuration files, variable sets and state backups, and the workspace remains able to read it on the next plan. Destroy is used to tear down resources, not to purge a credential from a working directory.

Immediate infrastructure destruction

Why it fails: A run plans and applies changes; it never destroys infrastructure unprompted, only the resources a plan explicitly removes. It is tempting because destroy runs exist, and selecting destroy mode would be the correct action when you deliberately need to tear down all managed infrastructure in a workspace.

Local environment cleanup

Why it fails: Local environment cleanup does not occur; runs execute on HCP Terraform's remote runners, which are ephemeral and discarded after completion, leaving the practitioner's machine untouched. It is tempting because local CLI runs can leave state files or plugins behind, so cleanup feels relevant, but remote execution removes that concern entirely.

Operations are always automatic

Why it fails: CLI-driven workflow means runs are queued and require explicit confirmation via the CLI or API; it does not make applies automatic. It is tempting because automatic apply exists, but that belongs to the auto-apply setting on VCS-connected workspaces, a separate configuration axis from the workflow type.

It disables remote state

Why it fails: CLI-driven workflow governs how runs are triggered and confirmed; it has no bearing on remote state, which is configured independently through the backend block. It is tempting because CLI runs often use local state, but disabling remote state is a backend choice, not a workflow-type effect.

The plan happens locally, apply remotely

Why it fails: In CLI-driven workflow the plan and apply both execute on the remote workspace after CLI-triggered runs are confirmed; planning does not happen locally. It is tempting because local plan is the default for plain CLI usage, but that describes the local workflow, not a CLI-driven remote workspace.

Manual UI file upload

Why it fails: Manual UI file upload pushes a one-off configuration snapshot into a workspace; it creates no persistent link to the version control provider, so commits do not synchronise. It is tempting when bootstrapping quickly, but continuous VCS integration requires connecting the repository through the workspace's version control settings.

FTP upload

Why it fails: FTP upload transfers files to a server but establishes no authenticated version control integration, so Terraform cannot poll commits or trigger runs from repository changes. It is tempting as a generic file transfer mechanism, yet workspace VCS connections require a supported provider API, such as GitHub or GitLab.

Emailing code to Terraform support

Why it fails: Emailing code to support is a manual human process with no API integration, so no automated synchronisation between repository commits and workspace runs can occur. It is tempting as an escalation path, but connecting a workspace to version control demands an authenticated provider connection configured in the workspace settings.

Unique state files for every module

Why it fails: Per-module state files fragment the workspace's single state, so resources and outputs can no longer be referenced across the configuration. Separate state files are correct when deliberately isolating blast radius between independent stacks, not for keeping multiple workspaces consistent.

Using local execution only

Why it fails: Local execution runs apply on the operator's machine, so runs bypass HCP Terraform's remote state locking, variable sets and policy checks, letting workspaces drift apart. Local execution is the right choice for air-gapped or offline development, not for coordinated multi-workspace consistency.

Manual copy-pasting of code

Why it fails: Copy-pasting code creates divergent, unversioned duplicates that drift as soon as one workspace changes, defeating any shared source of truth. Manual copying suits a one-off migration of a throwaway configuration, not ongoing consistency across workspaces.

Use the 'advisory' enforcement level on the policy.

Why it fails: Advisory enforcement only logs a warning and never blocks the run, so it cannot enforce the tag requirement. It would allow non-compliant instances to be created without any approval process, failing to meet the enforcement goal.

Use the 'hard-mandatory' enforcement level on the policy.

Why it fails: Hard-mandatory enforcement blocks the run entirely if the policy fails, with no option to override. This would prevent emergency changes even with approval, contradicting the need for a documented override. It is too strict for the scenario.

Configure the policy set to use the 'sentinel' CLI locally before applying.

Why it fails: Running the Sentinel CLI locally is a development practice, not a feature that enables overrides or enforcement in HCP Terraform. It does not integrate with the run workflow to allow emergency approvals. The requirement is about runtime enforcement and override capability, which are controlled by enforcement levels and policy logic.

The run trigger was configured with a delay of zero seconds, which is not supported and causes a race condition.

Why it fails: Run triggers do not have a configurable delay; they fire as soon as the upstream run reaches a terminal state. The issue is not about a delay setting but about state persistence timing. This option misrepresents how run triggers operate and would not resolve the race condition described.

The application workspace is not configured to use the networking workspace's state as a data source, so it relies on stale outputs.

Why it fails: Run triggers do not automatically share state; they only trigger runs. The application workspace must explicitly reference the networking workspace's outputs via a terraform_remote_state data source or similar. However, the scenario says the run applied correctly, implying the reference exists. The race condition is about timing, not missing configuration.

The networking workspace uses local state instead of remote state, so the run trigger cannot access the latest outputs.

Why it fails: If the networking workspace used local state, run triggers would not work at all because HCP Terraform requires remote state for run triggers. The scenario states the trigger fired and the application run applied, so remote state must be in use. This option contradicts the premise and does not explain the stale outputs.

Use Sentinel policies with 'hard-mandatory' enforcement.

Why it fails: Sentinel policies enforce compliance rules but do not provide an approval workflow. A hard-mandatory policy can block an apply if it fails, but it does not require a human to approve a successful plan. It is a policy check, not an approval gate, so it does not meet the requirement of preventing applies without approval.

Set the workspace's execution mode to 'Remote'.

Why it fails: Execution mode 'Remote' means runs execute in HCP Terraform's infrastructure, but it does not govern who can apply or whether approval is needed. It is about where the run executes, not access control. Changing execution mode would not prevent applies without approval.

Assign the 'Plan' permission to the team for the workspace.

Why it fails: The 'Plan' permission allows users to queue plans but not apply them. However, it does not enforce an approval step; users with apply permission could still apply directly. To require approval, you need a separate mechanism. This permission alone does not satisfy the requirement of preventing applies without approval.

Trigger a new run by pushing an empty commit to the VCS repository.

Why it fails: Pushing an empty commit would start a completely new run, including a new plan. This does not reuse the existing plan and may pick up other changes. It is inefficient and does not meet the goal of retrying only the apply.

Use the 'Retry' button on the run page in HCP Terraform to re-execute the apply.

Why it fails: The 'Retry' button re-runs the entire plan and apply cycle, not just the apply. This would generate a new plan, which might differ from the original if the state or configuration has changed. It does not satisfy the requirement to retry the apply without re-running the plan.

Run terraform apply locally using the saved plan file from the failed run.

Why it fails: The saved plan file is not directly accessible from HCP Terraform to local CLI. Even if it were, applying locally would bypass HCP Terraform's state locking and audit trail. This approach is not supported and could lead to state inconsistencies.

Set the workspace access to 'Public' and assign the 'developers' team the 'Write' permission.

Why it fails: Setting the workspace to 'Public' allows all organization members to view, but assigning 'Write' permission to the developers team gives them the ability to apply changes, not just queue plans. The requirement is only to queue plans, which corresponds to 'Plan' permission. 'Write' includes plan and apply, so this grants more access than needed.

Set the workspace access to 'Private' and assign the 'developers' team the 'Write' permission, then add all other organization members as 'Read' users.

Why it fails: Setting the workspace to 'Private' requires explicit user or team assignments for access. Adding all organization members as 'Read' users is cumbersome and not scalable. The 'Write' permission again grants apply rights, which exceeds the requirement. This approach is overly complex and does not align with the desired simplicity.

Set the workspace access to 'Public' and assign the 'developers' team the 'Admin' permission.

Why it fails: The 'Admin' permission grants full control over the workspace, including settings, deletion, and team management. This is far more access than needed for queuing plans and violates the principle of least privilege. While it would allow developers to queue plans, it also gives them unnecessary administrative capabilities that could be risky.

Set up a run trigger from a development workspace to the production workspace.

Why it fails: Run triggers automatically queue runs in a dependent workspace after a successful apply in a source workspace. This does not provide an approval gate for production applies; it merely chains runs. It also does not automatically plan on code merge to the main branch. This option is unrelated to the requirements and could introduce unintended automatic applies if not carefully configured.

Create a team with 'Read' permissions and assign it to the workspace.

Why it fails: A team with 'Read' permissions can view runs and state but cannot approve or apply changes. Assigning only read permissions would not allow designated reviewers to approve production applies; they would need at least 'Write' permissions to approve runs. This option does not satisfy the requirement and would prevent the team from performing necessary approvals.

Enable 'Auto-apply' on the workspace.

Why it fails: Auto-apply automatically applies a successful plan without human intervention, which contradicts the requirement that only designated reviewers can approve production applies. It removes the approval gate entirely, allowing any merged change to be applied immediately. This setting is suitable for non-production environments but fails to meet the team's need for controlled production changes.

Define the AWS provider block in a shared module and reference it from every workspace, embedding the credentials in the module source.

Why it fails: Embedding credentials in module source exposes them to anyone who can read the module, which directly violates the confidentiality requirement. It also does not stop a workspace from declaring its own provider block or passing different credentials, so owners can still override the centrally managed values.

Create an HCP Terraform agent pool in the project and store the AWS credentials as environment variables on the agent, then require all runs to use the agent.

Why it fails: Agent environment variables are not a supported place to inject per-project AWS credentials for workspace runs, and agents execute plans but do not themselves provide credentials to the provider configuration. This approach also does not prevent workspace owners from setting their own provider credentials, so the centralization goal is not met.

Store the AWS access key and secret in each workspace's Terraform variables, marked sensitive, and grant owners write access to variables.

Why it fails: Terraform variables marked sensitive are only redacted in output; they are still readable by anyone with permission to view the workspace's variables, and owners could change them. This fails both the confidentiality requirement and the no-override requirement, since workspace owners retain the ability to edit the values.

Examples of how to call the module with sample values.

Why it fails: Examples are highly valuable, but the question asks for TWO items that are essential for discoverability and usage. While examples are helpful, they are not as critical as documenting input variables and version constraints. Without those, users cannot effectively use the module. Examples complement but do not replace the core documentation.

The full source code of the module for reference.

Why it fails: The full source code is already available in the module registry and can be viewed there. Duplicating it in the README is redundant and makes the documentation harder to maintain. Consumers can access the code directly, so the README should focus on usage and requirements rather than duplicating the implementation.

A list of all resources that the module will create.

Why it fails: While listing resources can be informative, it is not essential for discoverability and usage. The module's behavior is better understood through input/output documentation and examples. Resource lists can become outdated and are not a substitute for proper variable and output descriptions. The focus should be on how to use the module, not an exhaustive inventory.

That the agent token has been rotated within the last 24 hours to remain valid.

Why it fails: Agent tokens do not expire on a 24-hour cycle; they remain valid until revoked. Rotation is a security practice, not a requirement for availability. An expired-token theory would not explain a no-agent-available error, and rotating tokens unnecessarily could disrupt running agents without fixing the underlying pool assignment.

That the workspace's Terraform version matches the version the agents were built with.

Why it fails: Agents execute whatever Terraform version the run requests and download it as needed, so a version mismatch is not the cause of a no-agent-available error. Version selection is a separate concern from pool availability. Checking versions first misdirects troubleshooting away from the assignment and execution mode that actually gate agent use.

That the workspace has been added to a run trigger so it can pull work from the agent pool.

Why it fails: Run triggers chain runs between workspaces and have nothing to do with agent availability. Agents poll the pool for queued jobs regardless of run triggers. Adding a trigger would not provide an agent and could introduce unintended run chaining, so it does not address the reported failure.