The stage workspace reads outputs from the prod-network workspace through terraform_remote_state. Security requires that no other workspace, including the dev workspaces in the same project, can read prod-network's state. How should prod-network be configured?
Select an answer to reveal the explanation.
Short Explanation
Remote state sharing is a guest list. You put only stage on it. Sharing with the whole project or organization is like leaving the door open, and tfe_outputs walks in with an API token rather than checking the list.
Full Explanation
Each workspace has a Remote State Sharing setting that controls which other workspaces can access its state during runs managed by HCP Terraform, which is what terraform_remote_state needs. The options are to share with all workspaces in the organization, with all workspaces in the same project, or with specific workspaces chosen in a searchable selector. Selecting only stage follows the documented least-privilege recommendation and excludes every other workspace. Sharing with the project would also include the dev workspaces in that project, which security forbids. Sharing with the organization opens state to every workspace, and team access settings on stage cannot narrow which workspaces read prod-network's state, because the sharing list is enforced on the producer. tfe_outputs authenticates through the tfe provider with a token, and the documentation states that remote state access controls do not apply to it, so it does not follow the sharing list. Exam caveat: terraform_remote_state needs access to the whole state snapshot, not only outputs, which is one reason to keep the list as small as possible; new workspaces default to specific-workspace sharing with an empty list. Operational check: queue a plan in stage and confirm it reads the outputs, then add a test data source in a dev workspace and confirm the plan fails with an access error.