Skip to content

Terraform Cloud access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Terraform Cloud, Black Cat runs 12 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Terraform Cloud connector needs.

Checks (12)

severity: critical Organization 2FA Not Enforced fix difficulty: easy #

Enable mandatory two-factor authentication for all organization members

  1. Log in to Terraform Cloud and navigate to Organization Settings > Authentication
  2. Under "Two-factor authentication", select "Require two-factor authentication"
  3. Save the setting; members without 2FA will be prompted to enroll on next login
  4. Verify all active members have 2FA enabled under Organization Settings > Members

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Organization SAML Not Enabled fix difficulty: medium #

Configure SAML SSO to enforce centralized identity provider authentication

  1. Log in to Terraform Cloud and navigate to Organization Settings > SSO
  2. Click "Set up SSO" and select your identity provider
  3. Enter the IdP metadata URL or upload the metadata XML
  4. Complete the SAML configuration and test the connection
  5. Enable the SSO enforcement option to require SAML for all members

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Organization Session Timeout Too Long fix difficulty: easy #

Reduce the session timeout to 24 hours or less to limit exposure from abandoned sessions

  1. Log in to Terraform Cloud and navigate to Organization Settings > Authentication
  2. Locate the "Session timeout" setting
  3. Set the timeout to 1440 minutes (24 hours) or less
  4. Save the setting and notify members that sessions will expire sooner

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Team Excessive Permissions fix difficulty: medium #

Reduce the number of broad organization-level permissions granted to the team

  1. Log in to Terraform Cloud and navigate to Organization Settings > Teams
  2. Select the team with excessive permissions
  3. Review each enabled organization-level permission and disable those not required by the team's function
  4. Apply the principle of least privilege by granting only permissions necessary for the team's role
  5. Save changes and notify team members of the updated access

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Team Workspace Admin Access fix difficulty: easy #

Downgrade the team's workspace access from admin to a least-privilege level such as write or read

  1. Log in to Terraform Cloud and open the affected workspace
  2. Navigate to Settings > Team Access
  3. Locate the team with admin access
  4. Change the access level to "write", "plan", or "read" as appropriate for the team's role
  5. Save the change and verify the team can still perform their required tasks

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Team Secret Visibility fix difficulty: easy #

Change team visibility from secret to organization to improve governance transparency

  1. Log in to Terraform Cloud and navigate to Organization Settings > Teams
  2. Select the team with secret visibility
  3. Change the "Visibility" setting to "Organization" so all members can see team membership
  4. Save the change and review whether any membership should remain confidential

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high User 2FA Not Enabled fix difficulty: easy #

Require the user to enable two-factor authentication or enforce 2FA at the organization level

  1. Log in to Terraform Cloud and navigate to Organization Settings > Authentication
  2. Enable "Require two-factor authentication" to enforce 2FA for all members
  3. Notify the affected user to enable 2FA in their account settings before the enforcement deadline
  4. If enforcing immediately, users without 2FA will be prompted on next login

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low User Pending Invitation fix difficulty: easy #

Resend or revoke pending user invitations that have not been accepted

  1. Log in to Terraform Cloud and navigate to Organization Settings > Members
  2. Review the list of pending invitations
  3. For invitations older than your policy threshold, click "Revoke invitation"
  4. Re-invite only those users who are confirmed to need access
  5. Consider setting an invitation expiry policy to auto-revoke stale invitations

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Sentinel Policy Advisory Only fix difficulty: easy #

Change the Sentinel policy enforcement level from advisory to hard-mandatory or soft-mandatory

  1. Log in to Terraform Cloud and navigate to Organization Settings > Policy Sets
  2. Locate the policy set containing the advisory policy
  3. Open the policy details and change "Enforcement level" to "soft-mandatory" or "hard-mandatory"
  4. Save the change and test a run to confirm the policy now blocks non-compliant infrastructure

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.23 SOC 2 Type II CC1.1 CIS Controls v8 CIS-05.1 NIST CSF 2.0 GV.RR GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.a.1 DORA (SaaS Security) DORA-9.1

severity: high Policy Set Overridable fix difficulty: easy #

Disable the overridable flag on the policy set to prevent workspace owners from bypassing policies

  1. Log in to Terraform Cloud and navigate to Organization Settings > Policy Sets
  2. Select the policy set with overridable enabled
  3. Disable the "Allow policy overrides" option
  4. Save the change; workspace owners will no longer be able to override failed policy checks

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.23 SOC 2 Type II CC1.1 CIS Controls v8 CIS-05.1 NIST CSF 2.0 GV.RR GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.a.1 DORA (SaaS Security) DORA-9.1

severity: medium Policy Set Not Global fix difficulty: easy #

Expand the policy set to apply globally or ensure all workspaces are explicitly covered

  1. Log in to Terraform Cloud and navigate to Organization Settings > Policy Sets
  2. Select the non-global policy set
  3. Either enable "Apply to all workspaces" or add the missing workspaces to the policy set scope
  4. Save the change and verify all critical workspaces are covered by policy enforcement

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.23 SOC 2 Type II CC1.1 CIS Controls v8 CIS-05.1 NIST CSF 2.0 GV.RR GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.a.1 DORA (SaaS Security) DORA-9.1

severity: medium Policy Set Empty fix difficulty: easy #

Add policies to the empty policy set or remove it if it is no longer needed

  1. Log in to Terraform Cloud and navigate to Organization Settings > Policy Sets
  2. Select the empty policy set
  3. Click "Add policies" and select the Sentinel policies to include
  4. Alternatively, delete the policy set if it serves no purpose
  5. Save changes and verify the policy set runs on the next plan

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.23 SOC 2 Type II CC1.1 CIS Controls v8 CIS-05.1 NIST CSF 2.0 GV.RR GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.a.1 DORA (SaaS Security) DORA-9.1

More Terraform Cloud checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial