Skip to content

Terraform Cloud configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Terraform Cloud, Black Cat runs 11 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Terraform Cloud connector needs.

Checks (11)

severity: medium Organization Force Delete Allowed fix difficulty: easy #

Disable force-delete to prevent accidental or malicious removal of workspaces with resources

  1. Log in to Terraform Cloud and navigate to Organization Settings > General
  2. Locate the "Allow force deleting workspaces" setting
  3. Disable the setting and save
  4. Ensure workspace deletion procedures include a destroy plan step before removal

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Organization Default Execution Mode Local fix difficulty: easy #

Change the default execution mode to remote to enable centralized state management and audit logging

  1. Log in to Terraform Cloud and navigate to Organization Settings > General
  2. Locate the "Default execution mode" setting
  3. Change it from "Local" to "Remote" or "Agent"
  4. Save the setting; existing workspaces inherit this default on next creation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Workspace No VCS Connection fix difficulty: medium #

Connect the workspace to a VCS repository to enable GitOps workflows and change traceability

  1. Log in to Terraform Cloud and open the workspace
  2. Navigate to Settings > Version Control
  3. Click "Connect to version control"
  4. Select your VCS provider and authorize access
  5. Choose the repository and branch, then save the configuration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Workspace Drift Detection Disabled fix difficulty: easy #

Enable drift detection to automatically detect infrastructure changes outside of Terraform

  1. Log in to Terraform Cloud and open the workspace
  2. Navigate to Settings > General
  3. Enable "Health assessments (drift detection)"
  4. Save the setting; Terraform Cloud will run periodic drift checks and report deviations

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Workspace Outdated Terraform Version fix difficulty: medium #

Upgrade the workspace to use Terraform 1.5.0 or later to receive security fixes and new features

  1. Log in to Terraform Cloud and open the workspace
  2. Navigate to Settings > General
  3. Update the "Terraform version" field to 1.5.0 or the latest stable release
  4. Save the setting and trigger a plan to validate compatibility
  5. Review any deprecation warnings or breaking changes in the Terraform upgrade guides

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Variable Set Priority Override fix difficulty: easy #

Disable priority override on the variable set to prevent silent overriding of workspace-level variables

  1. Log in to Terraform Cloud and navigate to Organization Settings > Variable Sets
  2. Select the variable set with priority override enabled
  3. Disable the "Priority" setting
  4. Save the change and review workspace variable definitions to ensure expected values take precedence

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Agent Pool Organization Scoped fix difficulty: medium #

Restrict the agent pool to specific workspaces rather than making it available organization-wide

  1. Log in to Terraform Cloud and navigate to Organization Settings > Agent Pools
  2. Select the organization-scoped agent pool
  3. Disable "Allow all workspaces to use this agent pool"
  4. Add only the workspaces that require access to this agent pool
  5. Save the change; other workspaces will no longer be able to assign this pool

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium VCS Connection Organization Scoped fix difficulty: hard #

Restrict the VCS connection to specific workspaces to limit credential exposure

  1. Log in to Terraform Cloud and navigate to Organization Settings > Version Control
  2. Review the organization-scoped VCS connection
  3. Consider replacing the shared connection with workspace-specific VCS connections using narrower permissions
  4. Assign the workspace-specific connection to only the workspaces that require it
  5. Revoke or retire the organization-scoped connection after migration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Run Task Advisory Enforcement fix difficulty: easy #

Change the run task enforcement level from advisory to mandatory to block non-compliant runs

  1. Log in to Terraform Cloud and open the workspace containing the run task
  2. Navigate to Settings > Run Tasks
  3. Locate the advisory run task and click the enforcement level selector
  4. Change the enforcement level to "Mandatory"
  5. Save and trigger a test run to confirm the task now blocks runs when it returns a failure

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Notification No HMAC Token fix difficulty: medium #

Add an HMAC token to the generic webhook notification to verify the authenticity of incoming payloads

  1. Generate a secure random token of at least 32 bytes
  2. Log in to Terraform Cloud and open the workspace
  3. Navigate to Settings > Notifications
  4. Edit the generic webhook notification and enter the token in the "Token" field
  5. Save the change and update the receiving webhook server to validate the X-TFC-Notification-Signature header

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low SSH Key Present fix difficulty: medium #

Review whether the SSH key is still in use and rotate or remove it if not required

  1. Log in to Terraform Cloud and navigate to Organization Settings > SSH Keys
  2. Review the listed SSH key and identify which workspaces use it
  3. If the key is no longer needed, click "Delete" to remove it from the organization
  4. If the key is still in use, rotate it by generating a new key pair, updating the key in Terraform Cloud, and updating the corresponding VCS server
  5. Document the purpose and owner of any retained SSH keys

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Terraform Cloud checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial