HFCP key terms

A plugin that lets Terraform talk to a specific platform's API, defining which resource types and data sources exist and how they are created, read, updated, and deleted.

Terraform's record of which real infrastructure objects it manages and their last known attributes, used to plan changes and detect drift between configuration and reality.

A dry-run comparison Terraform produces between desired configuration, stored state, and actual infrastructure, listing the create, update, and destroy actions it would take.

The Terraform step that executes the actions in a saved plan, calling provider APIs to reach the desired configuration and then refreshing state to match results.

A configuration that stores state outside the local machine, such as a cloud object store or HCP Terraform, enabling shared access, locking, and durability across a team.

A mechanism that prevents two Terraform runs from modifying the same state concurrently, avoiding corruption and conflicting changes when several people or pipelines operate together.

A block in Terraform configuration declaring one infrastructure object to manage, such as a network, compute instance, or DNS record, with arguments describing its desired settings.

A reusable, self-contained collection of Terraform configuration files that can be called with input variables and returns outputs, letting teams standardize repeated infrastructure patterns.

A declared input to a Terraform module or configuration that lets callers supply values without editing code, supporting defaults, type constraints, and validation rules.

A value a Terraform configuration exposes after apply, such as an IP address or endpoint, which can be shown to users or consumed by other configurations and modules.

The divergence between what Terraform state records and the actual state of infrastructure, often caused by manual console changes, which planning reveals as unexpected proposed actions.

A catalog of published Terraform providers and modules that teams can browse, version, and reference from configuration, with HCP Terraform offering a private registry for internal modules.

An isolated unit of Terraform runs, state, and variables inside HCP Terraform, letting one configuration be deployed to multiple environments or accounts with separate state.

A single execution of plan and apply inside HCP Terraform, triggered by a version control change, API call, or CLI, with logs, policy checks, and approvals recorded for auditing.

Expressing guardrails as machine-evaluated rules, such as Sentinel or Open Policy Agent policies, so infrastructure plans are checked automatically for violations before they can be applied.

HashiCorp's embeddable policy language and framework used in HCP Terraform to evaluate plans and state against organizational rules, producing soft or hard enforcement failures.

A pipeline pattern where a linked version control repository triggers HCP Terraform runs automatically on pull requests or merges, keeping infrastructure changes reviewed alongside application code.

Any sensitive value such as a password, API token, private key, or certificate that must be protected from unauthorized reading and ideally rotated on a defined schedule.

A Vault component that stores, generates, or encrypts data, such as the key-value store, database engine, or PKI engine, mounted at a path with its own configuration and policies.

Credentials Vault generates on demand for a user or service, with a limited lifetime and automatic revocation, replacing long-lived static passwords with short-lived ones.

The metadata attached to a Vault secret or token describing how long it remains valid and whether it is renewable, enabling automatic expiry and revocation of access.

The core Vault credential presented on requests, carrying attached policies and a TTL, and created through authentication methods or by other tokens with sufficient permission.

A Vault plugin that verifies an identity from an external source, such as Kubernetes service accounts, cloud IAM, or LDAP, and issues a Vault token bound to mapped policies.

A Vault document written in HCL that grants or denies capabilities such as read, create, or update on specified paths, defining what a token is allowed to do.

The process by which Vault starts locked with its master key protected, then reconstructs that key from unseal shares or an auto-unseal service so it can decrypt stored data.

The registration of a secrets engine or auth method at a path inside Vault, giving it an isolated namespace, configuration, and access rules within the server.

A client-side daemon that authenticates to Vault, caches and renews tokens, and renders secrets into files or environment variables for applications that cannot call the API directly.

An isolated virtual network within a cloud provider that defines its own address ranges, subnets, routing, and gateways, forming the boundary for the resources deployed inside it.

A contiguous range of IP addresses carved from a VPC and placed in one availability zone, used to group resources and control routing and public versus private exposure.

A set of rules attached to subnets that decides where traffic for each destination prefix is sent, such as a local network, internet gateway, or NAT device.

A stateful virtual firewall attached to resources that permits or denies inbound and outbound traffic by protocol, port, and source or destination address.

A managed service that lets instances in private subnets initiate outbound internet connections while preventing unsolicited inbound traffic from reaching them.

An infrastructure layer that handles service-to-service communication, providing mutual TLS, traffic routing, retries, and observability without changing application code.

A process deployed alongside each service instance that intercepts network traffic, enforcing mesh policies and collecting telemetry on behalf of the application.

Mutual TLS authentication in which both client and server present certificates, so each side verifies the other's identity and traffic is encrypted end to end.

A verifiable name and certificate assigned to a service instance, used by a mesh to authorize which services may communicate and to scope policies to workloads rather than hosts.

Consul's mechanism for declaring whether one service is allowed to connect to another, evaluated by the mesh to permit or deny traffic between service identities.

HashiCorp's service networking product providing service discovery, health checking, a service mesh with certificates, and key-value storage across multiple datacenters and clouds.

The mechanism by which clients locate healthy instances of a service, typically through a registry that tracks addresses and health rather than hard-coded endpoints.

A periodic probe that determines whether a service instance is functioning, so discovery and load balancing can route traffic only to healthy endpoints.

HashiCorp Cloud Platform, a managed offering that runs products such as Terraform, Vault, Consul, and Packer as hosted services with HashiCorp operating the control plane.

The top-level container in HCP Terraform that groups workspaces, teams, policies, and billing, and controls access through team membership and permissions.

A group of HCP Terraform users granted a shared permission level on selected workspaces, simplifying access management and separating duties across an organization.

A managed Vault cluster operated by HashiCorp, exposing the same API and features while the provider handles upgrades, availability, and infrastructure, with networking configured by the customer.

A non-human identity used by automation to authenticate to HashiCorp cloud services, carrying scoped permissions instead of relying on a person's credentials.

An automated sequence that builds, tests, and deploys changes, commonly running Terraform plan on pull requests and apply after merge with credentials supplied securely.

A dependency that causes a workspace's run to start after another workspace completes, used to sequence layered infrastructure such as networks before applications.

The baseline concepts of on-demand compute, storage, and networking delivered as services, including regions, availability zones, elasticity, shared responsibility, and pay-per-use billing.

Managing infrastructure through versioned, machine-readable configuration files instead of manual console actions, enabling review, repeatability, and automated provisioning.