Every CI pipeline in a company authenticates to HCP Terraform with one team API token created two years ago with no expiration date, and a pipeline log once leaked it. What should the platform team implement going forward?
Select an answer to reveal the explanation.
Short Explanation
One forever-token shared by everyone is a master key with no lock change scheduled. You want smaller keys, one per pipeline scope, each with an expiry date, and an organization cap so nobody can mint a forever-token again. And remember, a leaked token gets revoked now, not someday.
Full Explanation
HCP Terraform user, team and organization tokens each carry an expiration date and time, after which requests fail; HashiCorp recommends creating tokens valid for the shortest practical duration and notifies by email before expiry so they can be rotated. Organization owners can also set a maximum token lifetime in organization settings, which prevents new long-lived tokens. Splitting automation across team tokens scoped to the workspaces each pipeline needs limits the blast radius of any single leak, and scheduled rotation keeps every token well inside its lifetime. A token's expiration cannot be modified after creation, so extending the existing token is not possible; it should be revoked immediately because it already leaked. The organization token is intended for initial setup of workspaces and teams, and HashiCorp recommends team tokens for routine workspace interactions. User tokens do not expire with a browser session, and tying pipelines to a person creates an outage when that person leaves and grants the pipeline everything the owner can do. Exam caveat: rotation needs an automated path that updates the CI secret store, or expiry simply becomes an outage. Operational check: list team tokens filtered by expiry, confirm none lacks an expiration, and confirm the organization maximum lifetime is set.