Terraform Enterprise security reference

This page explains the aspects of the Terraform security model that are unique to Terraform Enterprise. We recommend also reviewing the core concepts in HCP Terraform Security model.

Disable Unneeded Admin Access

By default, port 8443 is reserved for the admin console UI and the system API. You can configure a different port number for those services by setting the TFE_ADMIN_HTTPS_PORT variable. You should only expose this port to infrastructure admins. To disable the admin console UI, you can set TFE_ADMIN_CONSOLE_DISABLED to true.

Personas

In addition to those listed in HCP Terraform Security model, Terraform Enterprise requires the following personas for managing and administering the application.

Infrastructure Admin

Outside of the application, administrators of the Terraform Enterprise deployment are responsible for managing the underlying infrastructure and upgrading the application. We recommend limiting the number of users who are infrastructure admins in your organization.

Site Admin

Site admins are responsible for application-level configuration of Terraform Enterprise. They can manage all users, workspaces, and organizations through the admin interface and have access to all data stored within Terraform Enterprise. Site admins are also responsible for configuring SAML and SCIM, and are the only users that can access Terraform Enterprise with a username and password once SAML is configured.

Terraform Enterprise grants extensive permissions to this role, so we recommend limiting the number of users who are site admins in your organization.

Differences Between Terraform Enterprise and HCP Terraform Security Models

All of the content on HCP Terraform security model applies to Terraform Enterprise, with the exception of the points listed below. Additionally, Terraform Enterprise supports SCIM 2.0 for automated user provisioning, which introduces additional security considerations documented in the SCIM Integration section.

Terraform Enterprise Requires You to Manage and Secure the Underlying Network and Infrastructure

Infrastructure admins are required to manage all aspects of the underlying infrastructure. This includes initial provisioning, secure configuration, access control, network ACL configuration, and OS-level software updates. Terraform Enterprise cannot ensure the security of your data if the underlying infrastructure is compromised.

You are Responsible for Updating Your Terraform Enterprise Deployment

We release security fixes, application features, and bug fixes for Terraform Enterprise each month. Infrastructure admins are responsible for applying updates.

You are Responsible for Availability, Backups, and Disaster Recovery

Infrastructure admins are responsible for all aspects of reliability and availability. Refer to Terraform Enterprise documentation on monitoring, backups and restores, and high availability mode (active/active) for more guidance on this topic.

Terraform Enterprise Isolates Terraform Operations via Docker Containers

Unlike HCP Terraform, Terraform Enterprise performs all Terraform operations in Docker containers on the Terraform Enterprise host. The containers are assigned to an isolated Docker network to prevent them from communicating with Terraform Enterprise backend services. However, Terraform Enterprise does not perform any egress filtering, so Terraform runs can still access available network resources.

SCIM Integration

Terraform Enterprise supports SCIM 2.0 (System for Cross-domain Identity Management) for automated user provisioning and team membership management from an Identity Provider (IdP) such as Okta or Microsoft Entra ID.

SCIM and SAML Relationship

SCIM requires SAML SSO to be enabled. When SCIM is enabled:

• SAML handles authentication only — users continue to log in via SAML SSO
• SCIM handles provisioning — user creation, updates, deactivation, and team membership are managed by the IdP
• Team membership in SAML assertions is ignored — the IdP manages team membership exclusively through SCIM

SCIM Bearer Tokens

SCIM tokens authenticate requests from your IdP to Terraform Enterprise. These tokens differ from user, team, and organization tokens:

Protect SCIM tokens with the same rigor as other privileged credentials. A compromised SCIM token can create users, modify team memberships, and provision site administrators.

Site Administrator Provisioning

SCIM can automatically grant site administrator privileges based on IdP group membership. Site admins configure which IdP group maps to site administrator access. Carefully control membership in this IdP group, as members will gain full administrative access to Terraform Enterprise.

SCIM-Managed Resources

Users and teams provisioned via SCIM are marked as "SCIM-managed" and cannot be modified through the TFE admin interface or API. This prevents de-synchronization between TFE and your IdP. To modify a SCIM-managed user or team, make the change in your IdP and allow SCIM to synchronize.

Site admins can pause SCIM synchronization globally if needed for debugging or emergency response.

Recommendations for Securely Operating Terraform Enterprise

In addition those provided in the HCP Terraform security model, we recommend the following for Terraform Enterprise users.

Run Terraform Enterprise in an Isolated Network, Limit Ingress Ports, and Restrict Access to Underlying Infrastructure

To minimize attack surface, we recommend running Terraform Enterprise in an isolated network and limiting ingress ports to only 80 and 443, as documented in Network Requirements for Terraform Enterprise.

Additionally, we recommend restricting access to the nodes that are running Terraform Enterprise. Terraform Enterprise can not ensure the security or integrity of your data if the underlying infrastructure is compromised.

Enable Optional Security Features

Once you are ready to use Terraform Enterprise for production workloads, we recommend enabling these optional security features.

Secure Secondary Hostnames

You can configure Terraform Enterprise to allow incoming connections at more than one hostname. Refer to Configure network access for instructions.

When configuring multiple hostnames, create and distribute TLS certificates for the secondary hostname in addition to the primary hostname. Refer to TLS settings in the deployment configuration reference for additional information.

Enable Strict Transport Security Header

You can configure Terraform Enterprise to set the Strict Transport Security (HSTS) header by setting TFE_TLS_ENFORCE in the application environment.

Disable Global Remote State Sharing

Terraform Enterprise allows site admins to enable global remote state sharing, which allows any workspace to access the state versions of any other workspace within the same organization. We recommend disabling this feature and relying on controlled remote state access if you need to share state between workspaces.

Treat Support Bundles with Care

Terraform Enterprise uses support bundles to share diagnostic information with HashiCorp support. Please note that support bundles may contain sensitive information from your Terraform Enterprise installation. You should not share them with untrusted parties and should delete them as soon as possible.

Update Terraform Enterprise Often

We release Terraform Enterprise updates each month. Updates may contain additional security features or fixes for existing security vulnerabilities, so we recommend establishing a process for periodically updating your Terraform Enterprise installation.

Subscribe to Terraform Enterprise Security Bulletins

We publish updates that address security vulnerabilities in HashiCorp products. You can find them in the Security category of HashiCorp Discuss.

We recommend that Terraform Enterprise infrastructure admins follow the documented steps to subscribe to email notifications or the RSS feed for Terraform Enterprise security updates.

Secure SCIM Integration

If you enable SCIM for automated user provisioning, follow these recommendations to maintain security.

Protect SCIM Bearer Tokens

SCIM tokens grant the ability to provision and deprovision users and modify team memberships across your entire Terraform Enterprise deployment. We recommend:

• Storing SCIM tokens securely within your IdP's configuration
• Rotating tokens before expiration (TFE displays warnings to site admins at 25% and 10% remaining TTL)
• Using multiple active tokens during rotation to avoid provisioning interruptions
• Deleting unused tokens promptly

Secure Your Identity Provider

When SCIM is enabled, Terraform Enterprise trusts your IdP to make accurate provisioning decisions. A compromised IdP could:

• Provision unauthorized users
• Grant site administrator access to malicious actors
• Modify team memberships to gain workspace access

Ensure your IdP follows security best practices, including strong authentication for IdP administrators and audit logging of provisioning changes.

Limit Site Administrator Provisioning via SCIM

If you configure SCIM to provision site administrators based on IdP group membership, restrict access to that IdP group. Periodically audit group membership to ensure only authorized personnel have site administrator access.