hashicorp / hashicorp/terraform-docs-common
Workspace Settings - Local Execution Mode - Explicitly state that team permissions are not gracefully regulated somehow
- Dominant language
- Makefile
- Stars
- 36
- Forks
- 133
- PR merge metrics
- No merged PRs in 30d
Description
A customer is not satisfied that within the current iteration of our documentation regarding [Execution Modes](https://www.terraform.io/cloud-docs/workspaces/settings#execution-mode) there's not an explicit statement about team permissions not getting gracefully regulated/upheld when using the `local` execution mode, and I'm struggling to figure out an eloquent way to do this.
For example:
You are running terraform apply against a workspace in your TFC org, where the team your token is associated to does *not* have permissions to upload state files, or run applies
If remote execution is selected, you'd get this message when you attempted to execute `terraform apply`:
```
PS C:\Users\zisom\Documents\exxon> terraform apply
╷
│ Error: Insufficient rights to apply changes
│
│ The provided credentials have insufficient rights to apply changes. In order to apply changes at least write permissions on the workspace are required.
╵
PS C:\Users\zisom\Documents\exxon>
```
If local execution is selected, the apply phase would execute, and when the apply was finished and terraform attempts to upload the new state file you'd see this message:
```
null_resource.delay (local-exec): [01]: 172.17.176.1
null_resource.delay (local-exec): [02]: fe80::8167:3d5c:2f54:7577
null_resource.delay (local-exec): Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
null_resource.delay: Creation complete after 2s [id=2000534191006407307]
╷
│ Error: Failed to save state
│
│ Error saving state: Error uploading state: resource not found
╵
╷
│ Error: Failed to persist state to backend
│
│ The error shown above has prevented Terraform from writing the updated state to the configured backend. To allow for recovery, the state has been written to the
│ file "errored.tfstate" in the current working directory.
│
│ Running "terraform apply" again at this point will create a forked state, making it harder to recover.
│
│ To retry writing this state, use the following command:
│ terraform state push errored.tfstate
│
╵
```
Through local execution, team permissions do not regulate the local execution of the binary. A person only would run into a situation with their permissions when there was an api call from the local binary that is not permitted, like in this case, uploading a state file. **How can this be expressed within our documentation?**
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the linked Execution Modes documentation for workspace settings and compare the described remote and local execution behavior. Update the documentation to state that local execution does not regulate team permissions for the local run, while permission checks still apply to API operations such as uploading state.】【。
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100