Terraform workflow

ScrinCloud treats Terraform delivery as a sequence of evidence-bound stages. Code, plan, policy, cost, approval, and apply do not collapse into one action.

Typical time

20–60 minutes

You need

A project and saved workspace revision

Outcome

A governed run record

The delivery sequence

Stage	Product action	Evidence to review
Prepare	Generate, import, edit, and Save All	Saved workspace revision
Format	Format run	Formatting status and logs
Validate	Validate run	Terraform validation result
Plan	Plan run	Exact revision, provider, region, and change summary
Policy	Policy check or Run guardrails review	Findings, scanner status, gates, and exceptions
Cost	Saved plan cost estimate	Assumptions, trust, unknown impact, policy findings
Approval	Reviewer decisions	Evidence-bound approval count, gates, comments, expiry
Apply	Apply approved plan	Exact approved plan and revision
Verify	Run details and resource map	Status, outputs, reconciliation, and audit evidence

Workflow 1 of 4 · Screenshot placeholder

Understand the delivery stages

Show a synthetic journey from saved revision through plan, guardrails, cost, approval, apply, and run evidence.

Future capture briefUse documentation-only project and workspace labels. Never show Terraform state, provider identities, plan bodies, resource identifiers, or customer cost.

Step 1: Prepare a saved revision

Open the Terraform editor for the intended project and workspace. Generate or import code, review every file, resolve editor diagnostics, then choose Save All. Terraform Runs can only start from a workspace with a saved latest revision.

See Prepare Terraform code.

Workflow 2 of 4 · Screenshot placeholder

Save the reviewed workspace revision

Show synthetic Terraform files, a clean revision state, and Save All.

Future capture briefUse harmless example code. Exclude state, plans, credentials, backend configuration, real resource names, repository URLs, and identifiers.

Step 2: Create non-apply runs

Open Runs, select the project, and choose New run. The create drawer offers Format, Validate, Plan, and Policy check for the latest saved revision.

Run the smallest useful check first. A successful Plan is a proposal, not permission to apply.

Workflow 3 of 4 · Screenshot placeholder

Start a controlled Terraform run

Show New Terraform Run with a synthetic workspace, latest saved revision, and Plan selected.

Future capture briefHide project, workspace, revision, provider-account, queue, and run identifiers.

Step 3: Review and approve the exact plan

Open the successful plan in Run Library. Review:

• project, workspace, environment, actor, provider account, and region;
• creates, updates, replacements, and deletes;
• mapped and unmapped resources;
• policy scanner and OPA status;
• cost estimate, assumptions, trust, and unknown impact;
• approval gates, eligible reviewers, comments, and expiry; and
• the revision and plan evidence identity.

If code, policy, provider connection, cost evidence, or plan changes, run and review a new plan. Approval cannot be transferred to a different plan.

Step 4: Apply and verify

Apply approved plan is available only from a successful plan with a current approved governance review. Confirm the high-impact action, then monitor the new apply run.

After completion, inspect status, timeline, resource map, logs, and safe artifacts. Do not treat a queued, running, failed, timed-out, or partially reconciled run as successful.

Workflow 4 of 4 · Screenshot placeholder

Apply the approved plan and verify evidence

Show the governed apply confirmation followed by a synthetic completed run detail view.

Future capture briefDo not show raw state, raw plan output, secrets, logs containing identifiers, provider accounts, resource addresses, actors, or audit IDs.

Safety rules

• Never apply from an older or changed revision.
• Never interpret Format, Validate, or Policy check as a plan.
• Never interpret a successful plan as approval.
• Never bypass a blocking policy, cost rule, approval gate, or reviewer floor.
• Never copy raw Terraform state or sensitive plan content into tickets.
• Use break-glass only for an approved emergency workflow with independent review and required post-event evidence.

Check your result

The workflow is complete only when the intended apply run reaches a successful terminal state and its exact revision, plan, governance, cost, provider, and audit evidence can be reviewed.

Common blockers

No workspace is available in New Terraform Run

Save a Terraform workspace revision first and confirm it belongs to the selected project.

Apply approved plan is disabled

The plan must be successful and its governance review must be currently APPROVED. Resolve stale, expired, blocked, rejected, cost, exception, or reviewer-gate states.

The runner is queued

Review queue status and estimated start information. Do not submit duplicates; run creation uses idempotency controls.

What is proven by this documentation?

Source code, API routes, Terraform wiring, and deployment matrices define the workflow. They do not prove a particular environment executed a live plan or apply. Live proof requires an approved runtime run and retained evidence.