Add a Terraform Cloud connector

Connect Harness to Terraform Cloud.

Use a Harness Terraform Cloud connector to connect Harness to your Terraform Cloud organization. Use the Terraform Cloud connector to run Terraform Cloud workspaces and runs from Harness pipelines.

What you will learn from this topic

How to create a Terraform Cloud connector using the Harness Manager.
How to define a Terraform Cloud connector using a YAML example.

Before you begin

Terraform Cloud URL: The URL of your Terraform Cloud or Terraform Enterprise instance, for example https://app.terraform.io.
Terraform Cloud API token: A Terraform Cloud API token, stored as a Harness secret. Go to API Tokens in the Terraform Cloud documentation to generate a user, team, or organization token, then store the token value as a Harness secret.
Harness Delegate: A running Harness Delegate that can reach your Terraform Cloud instance. Go to Delegate installation overview to install one. Connect through a Harness Delegate rather than the Harness Platform, because you need a delegate later to run Terraform Cloud steps in your pipelines.

Minimum permissions

The Terraform Cloud API token must allow the following operations:

List organizations: Required for the connector's connection test. If the token cannot list organizations, the connection test fails.
Create, apply, and discard runs, and lock, unlock, and manage state versions for the target workspace: Required if you use the token with the Terraform Cloud Run or Terraform Cloud Rollback pipeline steps.

Confirm the exact token scope with your Terraform Cloud administrator

Harness does not enforce a specific Terraform Cloud token type (user, team, or organization). Grant the token whichever scope covers the operations above for the organizations and workspaces the connector accesses.

Create a Terraform Cloud connector

Perform the following steps to create the Terraform Cloud connector using the Harness Manager.

Open a Harness project, and select Connectors under Project Setup. You can also create connectors at the account or organization levels.
Select New Connector, and then select Terraform Cloud under Cloud Providers.

Overview

Enter a Name for the connector. Description and Tags are optional. Harness automatically creates an Id (entity identifier) for the connector based on the Name. Select Continue to proceed to Credentials.

Credentials

Select Continue after entering the following details:

Terraform Cloud URL: Enter your Terraform Cloud or Terraform Enterprise URL, for example https://app.terraform.io.
API Token: Select Create or Select a Secret to add your Terraform Cloud API token. Go to Before you begin for how to generate the token.

Select Connectivity Mode

Under Connect to the provider, select how you want Harness to connect to Terraform Cloud, and then select Save and Continue:

Connect through Harness Platform: Harness communicates with Terraform Cloud securely through the Harness Platform. Credentials are encrypted and stored in the Secret Manager configured in Harness.
Connect through a Harness Delegate: Harness communicates with Terraform Cloud through a Harness Delegate installed in your environment. Select this option if Terraform Cloud is behind a corporate firewall.

A Harness Delegate is used for deployment operations even if you select Connect through Harness Platform.

Delegates Setup

This step appears only if you selected Connect through a Harness Delegate. Select one of the following options, and then select Save and Continue:

Use any available Delegate.
Only use Delegates with all of the following tags: Enter the tag of the delegate you installed.

Connection Test

Harness validates the Terraform Cloud connector authentication and permissions. Once verification succeeds, select Finish.

The connector now appears in the Connectors list.

Limitations

The Terraform Cloud connector supports API token authentication only. Harness does not validate whether the Terraform Cloud URL points to Terraform Cloud (SaaS) or a self-hosted Terraform Enterprise instance, so connectivity depends on the instance implementing the same API endpoints Harness calls.

YAML example

The following YAML defines a Terraform Cloud connector that authenticates using an API token and connects through a Harness Delegate.

Terraform Cloud connector YAML

connector:
  name: tf-cloud # Connector display name shown in the Harness UI
  identifier: tfcloud # Unique connector identifier, cannot be changed after creation
  description: "" # Optional description for the connector
  accountIdentifier: <YOUR_ACCOUNT_ID> # Harness account identifier that owns the connector
  orgIdentifier: default # Harness org identifier that owns the connector
  projectIdentifier: <YOUR_PROJECT_ID> # Harness project identifier that owns the connector
  type: TerraformCloud
  spec:
    terraformCloudUrl: https://app.terraform.io # Terraform Cloud or Terraform Enterprise URL
    credential:
      type: ApiToken
      spec:
        apiToken: account.<YOUR_TERRAFORM_CLOUD_TOKEN_SECRET_REF> # Harness secret reference storing your Terraform Cloud API token
    executeOnDelegate: true # Set to false to connect through the Harness Platform instead of a delegate
    ignoreTestConnection: false # Set to true to skip the connection test when the connector is saved

Next steps

Delegate installation overview: Install and configure a Harness Delegate for your Terraform Cloud connector.
Terraform Cloud Provisioning: Use the connector in a Harness Deploy stage to run and roll back Terraform Cloud workspaces.

PreviousAdd a Tanzu Application Service (TAS) connector

NextArtifact repositories

Last updated 12 days ago

Was this helpful?