How HCP Terraform applies access controls, policy checks, and dynamic provider credentials around shared infrastructure runs.
HCP Terraform governance controls what shared runs can do and who can initiate or approve them. It includes workspace permissions, policy enforcement, and credentials appropriate to a managed execution environment. These controls complement—not replace—configuration validation and provider authorization.
Dynamic provider credentials avoid placing long-lived cloud credentials in a workspace. HCP Terraform establishes a trust relationship with the cloud platform, obtains a fresh temporary credential for a plan or apply, and discards it after the run. HashiCorp’s dynamic-credentials documentation explains this OIDC-based model.
Policy enforcement evaluates organizational rules around a run; variable validation checks a configuration input. Keep these layers separate. A policy can prevent a noncompliant change from proceeding, but it does not make a risky resource configuration operationally safe by itself.