hashicorp / hashicorp/terraform-docs-common

Workspace Settings - Local Execution Mode - Explicitly state that team permissions are not gracefully regulated somehow

Open
#145 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Makefile
Stars
36
Forks
133
PR merge metrics
No merged PRs in 30d

Description

A customer is not satisfied that within the current iteration of our documentation regarding [Execution Modes](https://www.terraform.io/cloud-docs/workspaces/settings#execution-mode) there's not an explicit statement about team permissions not getting gracefully regulated/upheld when using the `local` execution mode, and I'm struggling to figure out an eloquent way to do this.

For example:

You are running terraform apply against a workspace in your TFC org, where the team your token is associated to does *not* have permissions to upload state files, or run applies

If remote execution is selected, you'd get this message when you attempted to execute `terraform apply`:

```
PS C:\Users\zisom\Documents\exxon> terraform apply

│ Error: Insufficient rights to apply changes

│ The provided credentials have insufficient rights to apply changes. In order to apply changes at least write permissions on the workspace are required.

PS C:\Users\zisom\Documents\exxon>
```

If local execution is selected, the apply phase would execute, and when the apply was finished and terraform attempts to upload the new state file you'd see this message:

```
null_resource.delay (local-exec): [01]: 172.17.176.1
null_resource.delay (local-exec): [02]: fe80::8167:3d5c:2f54:7577
null_resource.delay (local-exec): Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
null_resource.delay: Creation complete after 2s [id=2000534191006407307]

│ Error: Failed to save state

│ Error saving state: Error uploading state: resource not found


│ Error: Failed to persist state to backend

│ The error shown above has prevented Terraform from writing the updated state to the configured backend. To allow for recovery, the state has been written to the
│ file "errored.tfstate" in the current working directory.

│ Running "terraform apply" again at this point will create a forked state, making it harder to recover.

│ To retry writing this state, use the following command:
│ terraform state push errored.tfstate


```

Through local execution, team permissions do not regulate the local execution of the binary. A person only would run into a situation with their permissions when there was an api call from the local binary that is not permitted, like in this case, uploading a state file. **How can this be expressed within our documentation?**

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the linked Execution Modes documentation for workspace settings and compare the described remote and local execution behavior. Update the documentation to state that local execution does not regulate team permissions for the local run, while permission checks still apply to API operations such as uploading state.】【。

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.