Workspace execution modes in HCP Terraform determine how and where Terraform operations are performed. There are three primary execution modes available: Remote, Local, and Agent.
**Remote Execution Mode** is the default setting for HCP Terraform workspaces. In this mode, Terraform plans and appli…Workspace execution modes in HCP Terraform determine how and where Terraform operations are performed. There are three primary execution modes available: Remote, Local, and Agent.
**Remote Execution Mode** is the default setting for HCP Terraform workspaces. In this mode, Terraform plans and applies are executed on HCP Terraform's managed infrastructure. This provides several benefits including consistent execution environments, secure variable storage, and centralized state management. Team members can trigger runs through the UI, API, or VCS integrations, and all operations happen in the cloud.
**Local Execution Mode** allows you to run Terraform operations on your local machine while still using HCP Terraform for state storage and management. This is useful when you need access to local resources, credentials, or when debugging configurations. The state file remains stored in HCP Terraform, but the actual plan and apply commands execute locally.
**Agent Execution Mode** enables Terraform operations to run on self-hosted agents within your own infrastructure. This is particularly valuable when you need to access private resources behind firewalls or in air-gapped environments. Terraform Cloud Agents establish outbound connections to HCP Terraform and execute runs in your controlled environment.
To configure execution modes, navigate to workspace settings in the HCP Terraform UI or use the API. You can set the execution mode per workspace based on your specific requirements.
Key considerations when choosing execution modes include network access requirements, security policies, available credentials, and compliance needs. Remote mode offers simplicity and managed infrastructure, local mode provides flexibility for development, and agent mode bridges the gap between cloud management and private infrastructure access.
Understanding these execution modes is essential for the Terraform Associate certification as they represent fundamental concepts for managing infrastructure workflows effectively in enterprise environments.
Workspace Execution Modes in HCP Terraform
Why Workspace Execution Modes Matter
Understanding workspace execution modes is crucial for the Terraform Associate exam because it determines where and how your Terraform operations run. This affects security, performance, resource access, and overall workflow design in enterprise environments.
What Are Workspace Execution Modes?
Workspace execution modes define how Terraform plans and applies are executed within HCP Terraform (formerly Terraform Cloud). There are three primary execution modes:
1. Remote Execution Mode (Default) - Terraform runs execute on HCP Terraform's managed infrastructure - State is stored and managed remotely - Variables and secrets are stored securely in HCP Terraform - Best for most use cases as it provides consistency and collaboration features
2. Local Execution Mode - Terraform CLI runs locally on your machine - Only the state file is stored in HCP Terraform - Useful when you need access to local resources or credentials - Variables must be available locally
3. Agent Execution Mode - Runs use self-hosted Terraform Cloud Agents - Agents are deployed within your private network - Enables access to private infrastructure and resources - Ideal for organizations with strict network security requirements
How Execution Modes Work
Remote Mode: When you trigger a run (via VCS, API, or CLI), HCP Terraform queues the operation, provisions a worker, downloads your configuration, and executes the plan/apply on their infrastructure.
Local Mode: The Terraform CLI on your workstation performs the plan and apply operations. HCP Terraform serves as a remote backend for state storage only.
Agent Mode: Similar to remote mode, but the execution happens on an agent you deploy and manage. The agent polls HCP Terraform for jobs and executes them within your network perimeter.
Key Differences to Remember
| Feature | Remote | Local | Agent | |---------|--------|-------|-------| | Execution Location | HCP Terraform | Your machine | Your infrastructure | | State Storage | Remote | Remote | Remote | | Private Network Access | No | Yes | Yes | | Managed by | HashiCorp | You | You |
Exam Tips: Answering Questions on Workspace Execution Modes
Tip 1: When a question mentions accessing private or on-premises infrastructure, think Agent execution mode first.
Tip 2: If the scenario describes needing local credentials or files that cannot be uploaded to HCP Terraform, Local execution mode is likely the answer.
Tip 3: Remote execution is the default mode - remember this for questions asking about standard HCP Terraform behavior.
Tip 4: All three modes store state remotely in HCP Terraform. State storage location does not change based on execution mode.
Tip 5: Look for keywords in questions: - 'managed infrastructure' or 'collaboration' → Remote - 'local resources' or 'local credentials' → Local - 'private network' or 'firewall restrictions' → Agent
Tip 6: Agent mode requires a Business tier subscription in HCP Terraform. Free and Team tiers do not support agents.
Tip 7: Execution mode is configured at the workspace level, not globally. Different workspaces can use different execution modes.
Common Exam Scenarios
Scenario 1: Your organization needs to provision resources in a data center behind a firewall. Answer: Agent execution mode
Scenario 2: You want state stored remotely but need to run commands locally for debugging. Answer: Local execution mode
Scenario 3: A team wants consistent runs with centralized variable management. Answer: Remote execution mode