HCP Terraform: workspaces, VCS, and governance

# Configuring a workspace with VCS in HCP Terraform:
# 1. Connect the VCS provider (GitHub App, GitLab, Azure DevOps)
# 2. In the workspace: Settings → Version Control
# 3. Select the repository and branch to monitor

# In the code, connect using the cloud block:
terraform {
  cloud {
    organization = "my-company"
    workspaces {
      name = "prod-infra"  # workspace connected to the repo
    }
  }
}

# For local runs (without VCS, started from the CLI):
# terraform plan  → runs on HCP agents but is started locally

# Read outputs from another workspace (terraform_remote_state)
data "terraform_remote_state" "networking" {
  backend = "remote"
  config = {
    organization = "my-company"
    workspaces = {
      name = "prod-networking"
    }
  }
}

# Use the outputs from the networking workspace:
resource "aws_instance" "app" {
  subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_id
}

# Example Sentinel policy
# Requires that all resources have the "Environment" tag
import "tfplan/v2" as tfplan

# Get all resources from the plan
all_resources = filter tfplan.resource_changes as _, resource_change {
  resource_change.mode is "managed" and
  (resource_change.change.actions contains "create" or
   resource_change.change.actions contains "update")
}

# Verify they have the required tag
has_env_tag = rule {
  all all_resources as _, resource {
    resource.change.after.tags["Environment"] is not null
  }
}

# The policy passes if the rule is true
main = rule { has_env_tag }