HCP Terraform must manage resources in a private data center network that has no inbound access from the internet, and security forbids opening inbound firewall rules. Runs must stay governed by the workspace's permissions, policies and run history. Which approach meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
If HCP Terraform can't come into your network, let a piece of it live there. An agent sits inside, reaches out to HCP Terraform for work, and runs Terraform right next to your private systems. Nothing has to come knocking from outside.
Full Explanation
HCP Terraform agents are lightweight processes deployed within a specific network segment that let HCP Terraform manage isolated, private or on-premises infrastructure. Agents are grouped into agent pools, and a workspace whose execution mode is set to agent sends its runs to that pool. The agent connects out to HCP Terraform to pick up work and executes plan and apply inside the private network, so no inbound firewall rule is needed, while the run is still queued, governed and recorded by HCP Terraform with the workspace's permissions, policies and history. Local execution mode moves Terraform runs onto whatever machine runs the CLI, and HCP Terraform then only stores state, which gives up the centralized execution and governance the requirement asks for. Run tasks send run data to external services for checks such as security scanning; they report results back and do not execute Terraform on HCP Terraform's behalf. Opening inbound access from published IP ranges violates the stated security constraint. Exam caveat: the number of agents available depends on the HCP Terraform plan in use. Operational check: after assigning the pool, queue a plan and confirm the run details show it executed on an agent from that pool.