I85PREP
⌘ K
HFCP study materials
HFCP study resources

HFCP: Automation, CI/CD, and Collaboration

HFCP · Work through your exam, one topic at a time.

All guide sections

Automation, CI/CD, and Collaboration

Domain 7 - Automation, CI/CD, and Collaboration. This domain tests how Terraform and Vault fit into a delivery pipeline: reviewable plans, policy gates, short-lived credentials, and safe apply. Expect questions about run triggers, saved plans, and where secrets should live.

Core rules

  • A safe pipeline separates plan and apply. Plan runs on pull request; the plan artifact is reviewed; apply runs the exact saved plan after merge and approval.
  • Use remote state with locking so concurrent pipelines cannot corrupt state. In HCP Terraform, runs serialize through the workspace.
  • Authenticate pipelines with short-lived credentials: OIDC federation to the cloud provider, or Vault-issued dynamic secrets. Avoid long-lived access keys stored as CI variables.
  • Run tasks and Sentinel policies add checks between plan and apply. Notifications and run triggers connect workspaces - for example, a network workspace applies, then triggers the application workspace.
  • Modules belong in a versioned registry; pin versions and review changes like code.
  • Collaboration features: pull-request plans, comments, code owners, state history, and audit logs.

Worked example

A GitHub Actions workflow runs on pull requests: terraform fmt -check, terraform init, terraform validate, terraform plan -out=tfplan, then uploads the plan. On merge to main, a second job downloads the plan and runs terraform apply tfplan. The job authenticates to the cloud with GitHub OIDC, assuming a role scoped to the workspace, and fetches database credentials from Vault at runtime. The reasoning: reviewers approve the exact diff that will be applied, credentials expire, and no static secret is stored in the repository.

Traps

  • Re-planning at apply time and applying a different diff than the one reviewed.
  • Uploading plan files or state to public artifacts; both can contain sensitive values.
  • Using -auto-approve in production without a policy or approval gate.
  • Storing cloud keys as CI secrets when OIDC federation is available.
  • Triggering dependent workspaces before the upstream apply succeeds, or ignoring state lock failures.