docs: add remote execution page for Terraform/OpenTofu by nyobe · Pull Request #20570 · pulumi/docs

nyobe · 2026-07-29T21:03:45Z

Summary

Adds a new documentation page at /docs/iac/get-started/terraform/terraform-remote-execution/ covering Pulumi Cloud's remote execution support for Terraform and OpenTofu workloads
Updates the existing Terraform state backend page with remote execution callouts and corrected FAQ entries (drift detection, preventative policies)

New page covers

Setup with cloud {} block (and note that backend "remote" also works)
CLI workflows: plan, apply, saved plans/bookmarks, destroy/refresh/target
Run serialization (FIFO queue per workspace)
ESC integration with auto-provisioned environments and TF_VAR_* convention
VCS-triggered runs via deployment settings, with manual approval (confirm/discard)
Preventative policy enforcement
CI/CD example (GitHub Actions)
Execution mode control via terraform:execution-mode stack tag
HCP Terraform migration guide
FAQ

Test plan

make lint passes
make build passes
Visual review of rendered page on preview deploy

🤖 Generated with Claude Code

Co-Authored-By: Claire Gaestel claire@pulumi.com

pulumi-bot · 2026-07-29T21:20:40Z

Your site preview for commit 4073bf9 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-20570-4073bf99.s3-website.us-west-2.amazonaws.com

Changed pages:

Add a new documentation page covering Pulumi Cloud's remote execution support for Terraform and OpenTofu workloads. Covers setup with the cloud {} block, CLI workflows (plan, apply, saved plans, destroy/refresh), ESC integration with auto-provisioned environments, VCS-triggered runs via deployment settings, preventative policy enforcement, and HCP Terraform migration. Also updates the existing Terraform state backend page: - Adds remote execution callout in the "How it works" section - Updates drift detection FAQ (remote exec available, drift not yet) - Updates preventative policies FAQ and notes (now available with remote exec) Co-Authored-By: Claude <noreply@anthropic.com>

cnunciato

This is great! A few questions and suggestions from me, but otherwise seems good to go. Leaving you an approval to keep you unblocked.

cnunciato · 2026-07-31T19:19:01Z

+### Can I use drift detection with Terraform-managed stacks?

-Not currently. Drift detection and [Pulumi Deployments](/docs/pulumi-cloud/deployments/) require a Pulumi program to execute. If you want these features, you can [convert your Terraform code to Pulumi](/docs/iac/get-started/terraform/convert-hcl/) and then run updates with the Pulumi CLI.
+Not currently. Drift detection requires a Pulumi program. If you want this feature, you can [convert your Terraform code to Pulumi](/docs/iac/get-started/terraform/convert-hcl/) and run updates with the Pulumi CLI.


This would work for Pulumi HCL though, right? (If so, maybe a mention of that also.)

cnunciato · 2026-07-31T19:25:20Z

+
+Remote execution gives you:
+
+- **Consistent environment** — every plan and apply runs in the same managed infrastructure, not on individual developer machines


Should we mention approvals in this list?

cnunciato · 2026-07-31T19:25:48Z

+aliases:
+---
+
+Pulumi Cloud can run your Terraform and OpenTofu operations remotely. Instead of running `plan` and `apply` on your local machine, the Terraform or OpenTofu CLI uploads your configuration to Pulumi Cloud, which executes the operation in a managed container and streams the output back to your terminal in real time.


Would it be worth mentioning something about how this is designed to work like HCP Terraform and TFE?

cnunciato · 2026-07-31T19:58:09Z

+
+## How it works
+
+When you run `terraform plan` or `terraform apply` against a Pulumi Cloud workspace with remote execution enabled:


Suggested change

When you run `terraform plan` or `terraform apply` against a Pulumi Cloud workspace with remote execution enabled:

When you run `terraform plan` or `terraform apply` against a Pulumi Cloud workspace with [remote execution enabled](#enable-remote-execution):

cnunciato · 2026-07-31T19:59:05Z

+
+## How it works
+
+When you run `terraform plan` or `terraform apply` against a Pulumi Cloud workspace with remote execution enabled:


Are we calling these "workspaces", or "stacks"? They're technically stacks, right? (If so, maybe mention that the concepts are similar and that we call them stacks in Pulumi, then replace the "workspace" mentions throughout.)

cnunciato · 2026-07-31T20:08:40Z

+
+{{< /chooser >}}
+
+The saved plan file is a bookmark — the actual plan artifact is stored securely in Pulumi Cloud. When you apply the bookmark, Pulumi Cloud uses the original saved plan, guaranteeing that the apply matches exactly what you reviewed even if infrastructure drifted in the meantime.


Is it worth conveying how it's (presumably) scoped to this particular stack? Do successive plans run against this stack overwrite each other? 🤔

cnunciato · 2026-07-31T20:15:55Z

+
+1. Follow the [HCP Terraform state migration steps](/docs/iac/get-started/terraform/terraform-state-backend/#migrate-from-hcp-terraform-terraform-cloud) to move your state.
+1. Update your `cloud` block to point at Pulumi Cloud (change `hostname` and `organization`).
+1. Add your cloud credentials to the stack's [automatically provisioned ESC environment](#provide-credentials-with-esc) to replace workspace variables.


Would it make sense to mention anything about Vault integration here?

cnunciato · 2026-07-31T20:17:25Z

+
+### Is drift detection available?
+
+Not currently for Terraform-managed stacks. You can run `terraform plan` on a schedule via CI/CD to detect drift manually.


Should we mention that you can do this (assuming you actually can) through our HCL language support?

Per the companion docs PR (#20570), new stacks created through the Terraform or OpenTofu CLI default to remote execution; existing stacks enable it with a stack tag. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nyobe temporarily deployed to testing July 29, 2026 21:03 — with GitHub Actions Inactive

nyobe force-pushed the push-xntnnnyqwpnt branch from 6ea6d23 to b39da96 Compare July 29, 2026 22:26

nyobe temporarily deployed to testing July 29, 2026 22:26 — with GitHub Actions Inactive

nyobe force-pushed the push-xntnnnyqwpnt branch from b39da96 to fdb413b Compare July 29, 2026 22:50

nyobe temporarily deployed to testing July 29, 2026 22:50 — with GitHub Actions Inactive

nyobe force-pushed the push-xntnnnyqwpnt branch from fdb413b to b0ecc6e Compare July 29, 2026 23:03

nyobe temporarily deployed to testing July 29, 2026 23:03 — with GitHub Actions Inactive

nyobe force-pushed the push-xntnnnyqwpnt branch from b0ecc6e to 5ca50f6 Compare July 30, 2026 04:54

nyobe temporarily deployed to testing July 30, 2026 04:54 — with GitHub Actions Inactive

nyobe marked this pull request as ready for review July 30, 2026 15:36

nyobe force-pushed the push-xntnnnyqwpnt branch from 5ca50f6 to 4073bf9 Compare July 31, 2026 00:52

nyobe temporarily deployed to testing July 31, 2026 00:53 — with GitHub Actions Inactive

cnunciato reviewed Jul 31, 2026

View reviewed changes

djperlovsky mentioned this pull request Jul 31, 2026

blog: add "Bring Your Terraform Estate Into the Agentic Era" launch post #20569

Open

3 tasks

cnunciato mentioned this pull request Aug 2, 2026

Add walkthrough blog covering state backend, modules, and HCL #20644

Draft

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: add remote execution page for Terraform/OpenTofu - #20570

docs: add remote execution page for Terraform/OpenTofu#20570
nyobe wants to merge 1 commit into
masterfrom
push-xntnnnyqwpnt

nyobe commented Jul 29, 2026

Uh oh!

pulumi-bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

cnunciato left a comment

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

cnunciato Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		Remote execution gives you:

		- Consistent environment — every plan and apply runs in the same managed infrastructure, not on individual developer machines


		## How it works

		When you run `terraform plan` or `terraform apply` against a Pulumi Cloud workspace with remote execution enabled:


		{{< /chooser >}}

		The saved plan file is a bookmark — the actual plan artifact is stored securely in Pulumi Cloud. When you apply the bookmark, Pulumi Cloud uses the original saved plan, guaranteeing that the apply matches exactly what you reviewed even if infrastructure drifted in the meantime.


		### Is drift detection available?

		Not currently for Terraform-managed stacks. You can run `terraform plan` on a schedule via CI/CD to detect drift manually.

Uh oh!

Conversation

nyobe commented Jul 29, 2026

Summary

New page covers

Test plan

Uh oh!

pulumi-bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cnunciato left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pulumi-bot commented Jul 29, 2026 •

edited

Loading