A networking workspace in HCP Terraform publishes VPC and subnet IDs as outputs. Ten application teams read them with the tfe_outputs data source, and each team holds the Read workspace role on the networking workspace, which also lets them download complete state containing secrets. What is the least-privilege fix?
Select an answer to reveal the explanation.
Short Explanation
Your app teams only need the menu, not the keys to the kitchen. The fixed Read role includes reading full state, so you hand them a custom permission with state access set to Read outputs only. Watch out: Plan and Read both still include state reads, and sensitive doesn't stop downloads.
Full Explanation
HCP Terraform workspace permissions separate state access into No access, Read outputs only, Read, and Read and write. Read outputs only lets users retrieve the values in the latest state that are exposed as outputs, which is what tfe_outputs and output-based consumption need, while Read allows downloading complete state files, which often contain sensitive attributes. The fixed Read role includes Read state, so the least-privilege model is a custom workspace permission set that grants run and variable visibility as required with state access limited to Read outputs only. Marking outputs sensitive redacts them in the UI and API responses, but the full state file, with every resource attribute, remains downloadable under the Read role. The fixed Plan role builds on Read and also includes Read state, so it does not remove downloads. terraform_remote_state against an HCP Terraform workspace still requires permission on the source workspace and, in general, depends on access to the whole state snapshot, which is why tfe_outputs is the narrower option. Exam caveat: remote state sharing settings separately control which workspaces may read another workspace's state. Operational check: as a team member, confirm the outputs resolve in a plan and that downloading a state version from the networking workspace is denied.