In HCP Terraform, a consuming workspace needs a producing workspace's outputs. The producing team will not grant access to its full state and wants the shared values to stay current automatically after each apply. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
tfe_outputs is a reception desk that hands over only the outputs, instead of giving the visitor a key to the whole building. Each time the producer applies, the desk has the latest values ready. Your trap is the hand-copy option, which works right up until someone forgets.
Full Explanation
HashiCorp recommends the tfe_outputs data source in the tfe provider for reading another HCP Terraform or Terraform Enterprise workspace's outputs, because it does not require full access to the workspace's state; it reads the output values directly and treats them as sensitive by default. Each consumer run fetches the producer's current outputs, so values stay up to date after every producer apply without manual work. Workspaces also have a remote state sharing setting that controls which other workspaces may read their state, and combining narrow sharing with tfe_outputs keeps exposure minimal. terraform_remote_state reads the whole state snapshot, and HCP Terraform does not reduce that to outputs, which is why the documentation calls tfe_outputs the more secure option. Granting admin access on the producing workspace hands the consuming team control over runs, variables and settings, far beyond reading outputs. Copying values into a variable set by hand breaks the requirement for automatic updates and introduces drift whenever someone forgets a step. Exam caveat: a run trigger can additionally start a consuming workspace's run automatically after the producer applies. Operational check: add the data source, run a plan in the consumer, and confirm the expected output values resolve without granting state read access.