Terraform Cloud

Connect Terraform Cloud to collect infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Terraform Cloud:

   1. Team token (recommended, least privilege): in HCP Terraform go to Organization Settings › API Tokens and open the Team Tokens tab to create a new team token, for a team that has only read permissions.
   2. Copy the token now. HCP Terraform displays API tokens only once when you create them; they are obfuscated afterwards and must be regenerated if lost.
   3. Alternative: an organization owner can use Organization settings › API Token under the Organization Tokens header. Each organization has only one valid organization token, and it can perform CRUD on most resources, so prefer a read-only team token.

   Where to find the other values:

   • HCP Terraform host: If your URL includes portal.cloud.eu.hashicorp or app.eu.terraform.io, your organization is in HCP Europe (host app.eu.terraform.io).

   Terraform Cloud shows the secret only once, so copy it before you leave the page.

   Terraform Cloud's public documentation does not cover every step.

   Source: developer.hashicorp.com, checked 2026-10-07.

2. On Compliance › Connectors, open Terraform Cloud, click Connect, choose API token and fill in:

   Field	What to enter
   Organization or team API token	Required. Create under Organization settings → API tokens. HCP Terraform has no OAuth sign-in for integrations. Stored encrypted and never shown again.
   Organization name	Required.
   HCP Terraform host	Optional. app.terraform.io, or app.eu.terraform.io for HCP Europe. Self-hosted Terraform Enterprise is not supported.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Terraform Cloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks