Error: Apply not allowed for workspaces with a VCS connection

user_1329473 0
Viewed 3547
Error: Apply not allowed for workspaces with a VCS connection

I am getting this error when trying to apply a terraform plan via Github Actions.

Github Action (terraform apply)

- name: Terraform Apply Dev
  id: apply_dev
  if: github.ref == 'refs/heads/master' && github.event_name == 'push'
  run: TF_WORKSPACE=dev terraform apply -auto-approve deployment/

Terraform workspace The workspace was created on Terraform Cloud as a Version control workflow and is called app-infra-dev

Terraform backend

# The configuration for the `remote` backend.
terraform {
  backend "remote" {
    hostname = "app.terraform.io"
    organization = "my-org-name"
    workspaces {
      prefix = "app-infra-"
    }
  }
}

So because I called my workspace app-infra-dev, my workspace prefix in the backend file is app-infra- and TF_WORKSPACE=dev is set in my GH Action. I would have hoped that would have been enough to make it work.

Thanks for any help!

terraform github-actions
2 Answers

Your workspace type must be "API driven workflow".

https://learn.hashicorp.com/tutorials/terraform/github-actions

I had the same issue because I initially created it as "Version control workflow", which makes sense, but it doesn't work as expected.

Extracted from the documentation:

In the UI and VCS workflow, every workspace is associated with a specific branch of a VCS repo of Terraform configurations. Terraform Cloud registers webhooks with your VCS provider when you create a workspace, then automatically queues a Terraform run whenever new commits are merged to that branch of workspace's linked repository.

https://www.terraform.io/docs/cloud/run/ui.html#summary

user_26145840

Instead of if: github.ref == 'refs/heads/master' && github.event_name == 'push', you might consider trigger the apply on the GitHub event itself, as in this example

name: terraform apply

# Controls when the action will run.
on:
  # Triggers the workflow on push or pull request events but only for the main branch
  push:
    branches: [ master ]

In that example, you can see the terraform apply used at the end of a terraform command sequence:


# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  apply:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v2
      - uses: hashicorp/setup-terraform@v1
        with:
          terraform_wrapper: true
          terraform_version: 0.14.0

      # Runs a single command using the runners shell
      - name: create credentials
        run: echo "$GOOGLE_APPLICATION_CREDENTIALS" > credentials.json
        env:
          GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}

      - name: export GOOGLE_APPLICATION_CREDENTIALS
        run: |
          echo "GOOGLE_APPLICATION_CREDENTIALS=`pwd`/credentials.json" >> $GITHUB_ENV
      - name: terraform init
        run: terraform init

      - name: terraform workspace new
        run: terraform workspace new dev-tominaga
        continue-on-error: true

      - name: terraform workspace select
        run: terraform workspace select dev-tominaga
        continue-on-error: true

      - name: terraform init
        run: terraform init

      - name: terraform workspace show
        run: terraform workspace show

      - name: terraform apply
        id: apply
        run: terraform apply -auto-approve

Check if you can adapt that to your workflow.

VonC_63090
Related