Prepare Terraform code

Terraform Runs use a saved workspace revision. Unsaved editor changes are not a safe delivery boundary.

Typical time

10–30 minutes

You need

A project workspace and reviewed source

Next step

Create non-apply runs

Step 1: Open the correct workspace

Confirm the organization, project, workspace, environment, provider, region, cloud-account link, repository settings, and execution mode. Open the Terraform editor from that workspace.

Prepare 1 of 5 · Screenshot placeholder

Confirm the Terraform workspace

Show a synthetic workspace with environment, provider, region, and repository/execution context.

Future capture briefHide organization, project, workspace, provider connection, repository, branch, state backend, and runner identifiers.

Step 2: Generate or import deliberately

Use one approved source path:

• Generate Draft creates a reviewable Terraform draft from the saved architecture; or
• Import Terraform loads reviewed Terraform source.

Generation and import do not prove the code is valid, safe, complete, or approved. Review all files and reconcile unexpected resources.

Prepare 2 of 5 · Screenshot placeholder

Choose a reviewed source path

Show Generate Draft and Import Terraform with harmless example files.

Future capture briefDo not show customer code, repository URLs, secrets, state, provider configuration, private module sources, or backend credentials.

Step 3: Review files and diagnostics

Inspect the file tree and editor:

1. review provider and required-version constraints;
2. review variables, outputs, resources, modules, and data sources;
3. confirm environment-specific values are variables, not embedded secrets;
4. resolve syntax and editor diagnostics;
5. inspect architecture/code sync differences where applicable; and
6. remove state, plan, archive, log, key, credential, and environment files.

Prepare 3 of 5 · Screenshot placeholder

Review every Terraform file

Show a synthetic file tree, Monaco editor, and safe diagnostics without exposing infrastructure.

Future capture briefUse generic resource names and placeholder values. Exclude tokens, keys, credentials, IPs, account IDs, tenant IDs, state, and plan files.

Step 4: Save the revision

Choose Save All only after the file set is reviewed. Confirm the editor no longer reports unsaved changes and that revision history shows the new saved revision.

The revision is the source identity used by later runs. Editing after a plan creates a different source state and requires a new plan and approval.

Prepare 4 of 5 · Screenshot placeholder

Save the exact revision

Show Save All completing and a synthetic revision-history entry.

Future capture briefHide revision digests, actor identity, timestamps tied to a customer, repository metadata, and file contents.

Step 5: Run preparation checks

From the editor, Init prepares the approved runner context; Run plan starts a real runner-backed plan. From Runs, New run can start Format, Validate, Plan, or Policy check against the saved revision.

There is no separate Policy check button in the editor toolbar; use the Runs workflow when that action is required.

Prepare 5 of 5 · Screenshot placeholder

Choose the next runner action

Show Init and Run plan in the editor plus the New run action choices in Runs.

Future capture briefDo not show live terminal output, workspace tokens, provider credentials, state backend details, resource addresses, or real run IDs.

Check your result

You are ready to create runs when the intended files are saved in a latest workspace revision, diagnostics are understood, sensitive artifacts are absent, and the project/workspace/provider context is correct.

Common blockers

Save a Terraform workspace revision

The Runs page cannot start an action without latest_revision_id. Return to the editor, review changes, and choose Save All.

Generated code differs from the architecture

Use the code/canvas comparison and review unsupported or code-managed resources. Do not overwrite either side until the intended source of truth is clear.

Init or plan fails

Review the safe error and runner logs. Check workspace configuration, provider connection, variables, module access, and plan limits without exposing secrets.

For every editor, file, terminal, diff, health, code-sync, and inventory control, see Use the Terraform editor.