AzBuilder
Restrict Terraform Operations (Example: Destroy)
Feature description 💡
https://developer.hashicorp.com/terraform/cli/commands/login
Wanted to see we can restrict more auth like terraform login for preventing run from local machine
Anything else?
No response
Can you explain a little bit more about this?
Right now when you are doing a terraform login and you want for examle run a plan, apply or destroy the terraform command will be executed remotely not in your local machine.
Even if we are doing it on local machine then appropriate permission are required otherwise mistakenly if someone run destroy then it will destroy whole stuff
For now there is no way to prevent unwanted terraform actions if you are using terraform remote state.
You can give access to certain groups to a organization, but once you have "manage workspace" you can do anything unless you do some kind of customization inside the terrakube templates
I am using the template to restrict the deployment to only selected branches, now the new version supports a similar feature for the webhook, I am wondering for VCS workflow, should deployment and destroy be restricted to be kicked off only from the Terrakube UI? aka, only plan can be run from local. I remember this is the action TFC takes.
