HashiCorp Cloud Platform (HCP) Operations
Domain 6 - HashiCorp Cloud Platform (HCP) Operations. This domain tests how HCP delivers managed HashiCorp products and how organizations, projects, workspaces, and access are structured. Expect questions on HCP Terraform run execution, variable handling, agents, and governance features.
Core rules
- HCP is HashiCorp's managed platform. HCP Terraform provides remote runs, state storage, a private module registry, policy enforcement, and run tasks. HCP Vault and HCP Consul provide managed clusters with their own networking and access controls.
- The hierarchy is organization → projects → workspaces. Projects group workspaces and scope access; workspaces hold configuration, variables, and state.
- An HCP Terraform workspace is not a Terraform CLI workspace. A CLI workspace is a state partition inside one configuration; an HCP workspace is a full unit with its own VCS connection, variables, run history, and state.
- Runs can be VCS-driven, API-driven, or CLI-driven. Remote runs execute in HCP-managed workers; agent pools run them in your network for private access.
- Variables are scoped and typed: Terraform variables feed configuration, environment variables affect the run, and variable sets share values across workspaces. Sensitive values are write-only in the UI.
- Governance includes Sentinel policy sets, run tasks, cost estimation, and audit logging. Policy enforcement levels are advisory, soft-mandatory, and hard-mandatory.
Worked example
A team connects a GitHub repository to an HCP Terraform workspace, sets the working directory to infra/, and adds a variable set containing the cloud region. A pull request triggers a speculative plan; reviewers see the plan in the PR. On merge, a new run executes and applies after approval. State stays in HCP Terraform with locking, so two runs cannot apply concurrently. The reasoning: the workspace owns the configuration and state; VCS integration supplies the trigger; policy and approval gates sit between plan and apply.
Traps
- Confusing HCP workspaces with CLI workspaces and expecting CLI workspace commands to manage HCP workspaces.
- Assuming remote runs can reach private networks without an agent pool.
- Treating cost estimation as a hard budget control; it is informational.
- Assuming variable values are unambiguous when both workspace variables and variable sets define the same key; check precedence.
- Believing a speculative plan applies changes; it does not.