HashicorpTerraform

Hashicorp Terraform provide infrastructure automation to provision and manage resources in any cloud or data center with Terraform.
This integration was integrated and tested with version v1.4.4 of HashicorpTerraform.

Configure HashiCorp Terraform in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

terraform-runs-list

List runs in a workspace.

Base Command

terraform-runs-list

Permissions

This command requires a User or Team token that has admin level access to the workspace. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

Command example

#### Context Example

```json
{
    "Terraform": {
        "Run": {
            "data": [
                {
                    "attributes": {
                        "actions": {
                            "is-cancelable": false,
                            "is-confirmable": true,
                            "is-discardable": true,
                            "is-force-cancelable": false
                        },
                        "allow-config-generation": false,
                        "allow-empty-apply": false,
                        "auto-apply": false,
                        "canceled-at": null,
                        "created-at": "2023-12-17T10:23:43.258Z",
                        "has-changes": true,
                        "is-destroy": false,
                        "message": "Triggered via UI",
                        "permissions": {
                            "can-apply": true,
                            "can-cancel": true,
                            "can-comment": true,
                            "can-discard": true,
                            "can-force-cancel": true,
                            "can-force-execute": true,
                            "can-override-policy-check": true
                        },
                        "plan-only": false,
                        "refresh": true,
                        "refresh-only": false,
                        "replace-addrs": [
                            "fakewebservices_load_balancer.primary_lb"
                        ],
                        "save-plan": false,
                        "source": "tfe-ui",
                        "status": "planned",
                        "status-timestamps": {
                            "plan-queueable-at": "2023-12-17T10:23:43+00:00",
                            "plan-queued-at": "2023-12-17T10:23:43+00:00",
                            "planned-at": "2023-12-17T10:23:52+00:00",
                            "planning-at": "2023-12-17T10:23:48+00:00",
                            "queuing-at": "2023-12-17T10:23:43+00:00"
                        },
                        "target-addrs": null,
                        "terraform-version": "1.4.4",
                        "trigger-reason": "manual",
                        "variables": []
                    },
                    "id": "run-8wpCneWr4TLSzfat",
                    "links": {
                        "self": "/api/v2/runs/run-8wpCneWr4TLSzfat"
                    },
                    "relationships": {
                        "apply": {
                            "data": {
                                "id": "apply-uEYtCmrtg5MvjgTr",
                                "type": "applies"
                            },
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/apply"
                            }
                        },
                        "comments": {
                            "data": [],
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/comments"
                            }
                        },
                        "configuration-version": {
                            "data": {
                                "id": "cv-YDcZaBNiRbrdy1w1",
                                "type": "configuration-versions"
                            },
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/configuration-version"
                            }
                        },
                        "created-by": {
                            "data": {
                                "id": "user-LR5kedWrdZXBWF71",
                                "type": "users"
                            },
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/created-by"
                            }
                        },
                        "plan": {
                            "data": {
                                "id": "plan-T7zpGYFEioRfWEAq",
                                "type": "plans"
                            },
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/plan"
                            }
                        },
                        "policy-checks": {
                            "data": [],
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/policy-checks"
                            }
                        },
                        "run-events": {
                            "data": [
                                {
                                    "id": "re-ga2h6eu41RqrmZRn",
                                    "type": "run-events"
                                },
                                {
                                    "id": "re-ciqzHkW3bDooRzcn",
                                    "type": "run-events"
                                },
                                {
                                    "id": "re-ENvbqnmE72YFj7Wq",
                                    "type": "run-events"
                                },
                                {
                                    "id": "re-xkz1fSTKM25GxkMk",
                                    "type": "run-events"
                                }
                            ],
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/run-events"
                            }
                        },
                        "task-stages": {
                            "data": [],
                            "links": {
                                "related": "/api/v2/runs/run-8wpCneWr4TLSzfat/task-stages"
                            }
                        },
                        "workspace": {
                            "data": {
                                "id": "ws-ZTbNWsfXHRWRVNmE",
                                "type": "workspaces"
                            }
                        }
                    },
                    "type": "runs"
                }
            ],
            "links": {
                "first": "https://app.terraform.io/api/v2/workspaces/ws-ZTbNWsfXHRWRVNmE/runs?page%5Bnumber%5D=1&page%5Bsize%5D=20",
                "last": "https://app.terraform.io/api/v2/workspaces/ws-ZTbNWsfXHRWRVNmE/runs?page%5Bnumber%5D=1&page%5Bsize%5D=20",
                "next": null,
                "prev": null,
                "self": "https://app.terraform.io/api/v2/workspaces/ws-ZTbNWsfXHRWRVNmE/runs?page%5Bnumber%5D=1&page%5Bsize%5D=20"
            },
            "meta": {
                "pagination": {
                    "current-page": 1,
                    "next-page": null,
                    "page-size": 20,
                    "prev-page": null,
                    "total-count": 9,
                    "total-pages": 1
                },
                "status-counts": {
                    "applied": 1,
                    "apply-queued": 0,
                    "applying": 0,
                    "assessed": 0,
                    "assessing": 0,
                    "canceled": 2,
                    "confirmed": 0,
                    "cost-estimated": 0,
                    "cost-estimating": 0,
                    "discarded": 4,
                    "errored": 0,
                    "fetching": 0,
                    "fetching-completed": 0,
                    "pending": 0,
                    "plan-queued": 0,
                    "planned": 1,
                    "planned-and-finished": 4,
                    "planned-and-saved": 0,
                    "planning": 0,
                    "policy-checked": 0,
                    "policy-checking": 0,
                    "policy-override": 0,
                    "policy-soft-failed": 0,
                    "post-apply-completed": 0,
                    "post-apply-running": 0,
                    "post-plan-awaiting-decision": 0,
                    "post-plan-completed": 0,
                    "post-plan-running": 0,
                    "pre-apply-awaiting-decision": 0,
                    "pre-apply-completed": 0,
                    "pre-apply-running": 0,
                    "pre-plan-awaiting-decision": 0,
                    "pre-plan-completed": 0,
                    "pre-plan-running": 0,
                    "queuing": 0,
                    "queuing-apply": 0,
                    "total": 12
                }
            }
        }
    }
}

Human Readable Output

Terraform Runs

Plan id	Planned at	Run id	Status
plan-T7zpGYFEioRfWEAq	2023-12-17T10:23:52+00:00	run-8wpCneWr4TLSzfat	planned
plan-1JUTBdedobs1Absf	2023-12-11T11:35:35+00:00	run-kMNQfAmoDr1k8eaT	discarded
plan-21bfTFiDJ6Rz1VTZ		run-jb2j5r3gBievUPfR	canceled
plan-twBdAcLwiGwuE7kt	2023-12-11T11:29:38+00:00	run-g7ihSa71hCV9yZt7	discarded
plan-JEgrv5aBeNUDDRaA	2023-12-11T11:12:04+00:00	run-yCYvcx1ZEmmKGXnB	discarded
plan-kJLmtoaywxkXM54P	2023-12-11T09:11:48+00:00	run-akCRvcJ6L5cQtAhc	discarded
plan-ZunKDF28KpCyiZAn	2023-12-10T07:10:08+00:00	run-rpSjBkbhiKAfMuwX	planned_and_finished
plan-V4fvpvCzGQrsZikD	2023-11-30T09:21:42+00:00	run-Q2kS54r6pJjdyYfk	planned_and_finished
plan-ZYYZD69ESo16jENX	2023-10-25T10:33:11+00:00	run-wBdFQ6egn91GGRne	applied

terraform-run-action

Perform an action on a Terraform run. The available actions are: apply, cancel, discard, force-cancel, force-execute.

Base Command

terraform-run-action

Permissions

This command requires a User or Team token that has admin level access to the workspace. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

There is no context output for this command.

Command example

!terraform-run-action run_id=run-8wpCneWr4TLSzfat action="discard" comment="test comment"

Human Readable Output

Successfully queued an discard request for run id run-8wpCneWr4TLSzfat

terraform-plan-get

Get the plan JSON file or the plan meta data.

Base Command

terraform-plan-get

Permissions

This command requires a User or Team token that has admin level access to the workspace. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

Command example

!terraform-plan-get plan_id=plan-V4fvpvCzGQrsZikD

Context Example

{
    "Terraform": {
        "Plan": {
            "attributes": {
                "actions": {
                    "is-exportable": true
                },
                "execution-details": {
                    "mode": "remote"
                },
                "generated-configuration": false,
                "has-changes": false,
                "log-read-url": "url",
                "permissions": {
                    "can-export": true
                },
                "resource-additions": 0,
                "resource-changes": 0,
                "resource-destructions": 0,
                "resource-imports": 0,
                "status": "finished",
                "status-timestamps": {
                    "agent-queued-at": "2023-11-30T09:21:33+00:00",
                    "finished-at": "2023-11-30T09:21:41+00:00",
                    "started-at": "2023-11-30T09:21:37+00:00"
                },
                "structured-run-output-enabled": true
            },
            "id": "plan-V4fvpvCzGQrsZikD",
            "links": {
                "json-output": "/api/v2/plans/plan-V4fvpvCzGQrsZikD/json-output",
                "json-output-redacted": "/api/v2/plans/plan-V4fvpvCzGQrsZikD/json-output-redacted",
                "json-schema": "/api/v2/plans/plan-V4fvpvCzGQrsZikD/json-schema",
                "self": "/api/v2/plans/plan-V4fvpvCzGQrsZikD"
            },
            "relationships": {
                "exports": {
                    "data": []
                },
                "state-versions": {
                    "data": []
                }
            },
            "type": "plans"
        }
    }
}

Human Readable Output

Terraform Plan

Agent Queued at	Plan id	Status
2023-11-30T09:21:33+00:00	plan-V4fvpvCzGQrsZikD	finished

Command example

!terraform-plan-get plan_id=plan-V4fvpvCzGQrsZikD json_output="true"

Context Example

{
    "InfoFile": {
        "EntryID": "375@03d8b507-a516-4959-8133-979b2d80a807",
        "Extension": "json",
        "Info": "application/json",
        "Name": "plan-V4fvpvCzGQrsZikD.json",
        "Size": 3686,
        "Type": "JSON data"
    }
}

Human Readable Output

terraform-policies-list

List the policies for an organization or get a specific policy.

Base Command

terraform-policies-list

Permissions

This command requires a User or Team token that has admin level access to the workspace. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

Command example

#### Context Example

```json
{
    "Terraform": {
        "Policy": {
            "attributes": {
                "description": null,
                "enforce": [
                    {
                        "mode": "hard-mandatory",
                        "path": "nat-policies.sentinel"
                    }
                ],
                "enforcement-level": "hard-mandatory",
                "kind": "sentinel",
                "name": "nat-policies",
                "policy-set-count": 1,
                "updated-at": "2023-11-14T18:12:36.702Z"
            },
            "id": "pol-ycCqXorxsFjaH5aK",
            "links": {
                "download": "/api/v2/policies/pol-ycCqXorxsFjaH5aK/download",
                "self": "/api/v2/policies/pol-ycCqXorxsFjaH5aK",
                "upload": "/api/v2/policies/pol-ycCqXorxsFjaH5aK/upload"
            },
            "relationships": {
                "organization": {
                    "data": {
                        "id": "example-org-40dc3b",
                        "type": "organizations"
                    }
                },
                "policy-sets": {
                    "data": [
                        {
                            "id": "polset-hc2bvqDW8YRgHEt8",
                            "type": "policy-sets"
                        }
                    ]
                }
            },
            "type": "policies"
        }
    }
}

Human Readable Output

Terraform Policies

Kind	Organization id	Policy Set ids	Policy id	Policy name
sentinel	example-org-40dc3b	polset-hc2bvqDW8YRgHEt8	pol-ycCqXorxsFjaH5aK	nat-policies

terraform-policy-set-list

List the policy sets for an organization or get a specific policy set.

Base Command

terraform-policy-set-list

Permissions

This command requires a User or Team token that has admin level access to the workspace. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

Command example

#### Context Example

```json
{
    "Terraform": {
        "PolicySet": {
            "attributes": {
                "agent-enabled": false,
                "created-at": "2023-11-08T11:25:06.196Z",
                "description": null,
                "global": false,
                "kind": "sentinel",
                "name": "test-policy-set",
                "policy-count": 1,
                "project-count": 0,
                "updated-at": "2023-11-08T11:25:06.196Z",
                "versioned": false,
                "workspace-count": 1
            },
            "id": "polset-hc2bvqDW8YRgHEt8",
            "links": {
                "self": "/api/v2/policy-sets/polset-hc2bvqDW8YRgHEt8"
            },
            "relationships": {
                "organization": {
                    "data": {
                        "id": "example-org-40dc3b",
                        "type": "organizations"
                    }
                },
                "policies": {
                    "data": [
                        {
                            "id": "pol-ycCqXorxsFjaH5aK",
                            "type": "policies"
                        }
                    ]
                },
                "projects": {
                    "data": []
                },
                "workspace-exclusions": {
                    "data": []
                },
                "workspaces": {
                    "data": [
                        {
                            "id": "ws-u7kVixWpJYWiERMG",
                            "type": "workspaces"
                        }
                    ]
                }
            },
            "type": "policy-sets"
        }
    }
}

Human Readable Output

Terraform Policy Sets

Organization	Policies ids	Policy Set name	Policy set id	Workspaces
example-org-40dc3b	pol-ycCqXorxsFjaH5aK	test-policy-set	polset-hc2bvqDW8YRgHEt8	ws-u7kVixWpJYWiERMG

terraform-policies-checks-list

List the policy checks for a Terraform run.

Base Command

terraform-policies-checks-list

Permissions

This command requires a User or Team token that has admin level access to the workspace. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

Command example

!terraform-policies-checks-list run_id=run-8wpCneWr4TLSzfat

Human Readable Output

Terraform Policy Checks

No entries.

terraform-get-events

Retrieves Terraform audit trail events. This command is supported in Cortex XSIAM only and is intended for development and debugging purposes, as it may produce duplicate events.

Base Command

terraform-get-events

Permissions

This command requires the audit-logging feature entitlement for the organization as well as an Audit trail or Organization token. Refer to HashiCorp Terraform API Token Access Levels.

Input

Context Output

There is no context output for this command.

Command example

!terraform-get-events limit=2

Human Readable Output

Terraform Audit Trail Events

timestamp	id	version	type	auth	request
2025-09-21T11:24:26.541Z	ae66e491-aaaa-457c-8445-9c908ee726aa	0	Resource	{“accessor_id”: “user-xxxxxxxxxxxx”, “description”: “example-userA”}	{“id”: “4df584d4-7e2a-aaaa-6cc0-4adbefa020e6”}
2025-09-21T11:24:26.541Z	ae66e491-bbbb-457c-8445-9c908ee726bb	0	Resource	{“accessor_id”: “user-yyyyyyyyyyyy”, “description”: “example-userB”}	{“id”: “4df584d4-7e2a-bbbb-6cc0-4adbefa020e6”}

Troubleshooting

• HTTP 429 (Too many requests) Errors
  • Typically occur when the 30 requests per second API limit is exceeded when paginating over audit trail events.
  • To avoid such errors, reduce the Maximum Number of Audit Events Per Fetch parameter value.
  • For additional information, refer to HashiCorp Terraform API Rate Limits.

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

• Fetch events

</~PLATFORM>