> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-enterprise-run-tasks.md).
# Terraform Enterprise (Run Tasks)
Integrate Prisma Cloud with Terraform Enterprise (Run Tasks) to allow dynamic, automated, and context-specific scans in your Terraform workspace.
With the integration of Terraform Enterprise, Prisma Cloud, scans your Terraform frameworks to identify misconfigurations based on Prisma Cloud’s default policies, as well as custom policies created by your organization for specific needs. This scanning process occurs whenever changes are pushed or triggered in your workflow, ensuring security checks are integrated seamlessly. Prisma Cloud identifies issues such as misconfigurations in your infrastructure-as-code (IaC) files, software composition analysis (SCA) vulnerabilities\*, exposed secrets, and license non-compliance as soon as they are introduced.
\*Prisma Cloud performs 'Image Referencer scans to analyze the contents, dependencies, and configurations of container images in order to detect known vulnerabilities, as full SCA scans are not supported for Terraform Enterprise (Run Tasks).
Runs in Terraform are performed within a workspace, or a working directory when running Terraform locally. The workspace provides providing the configuration, state, and variables for the run. Terraform Enterprise maintains a run queue, processing runs sequentially. Each run progresses through multiple run stages; pending, plan, cost estimation, policy check, apply, and completion.
Users can monitor the run status (pass/fail) and remediate issues directly on the Prisma Cloud console. Prisma Cloud offers automated shift-left actions such as notifying developers or creating tickets, based on scan results. In addition, you can track the run status on Terraform Enterprise through streamlined run task reviews, which offer detailed descriptions of violations and fixes provided by Prisma Cloud within their Terraform deployment environment. For more information about streamlined tasks, refer to .
The following integration includes workflows involving third party tools such as Terraform and GitHub. These are general guidelines only, intended to help you. You must always follow the official third party documentation.
1. Before you begin.
* **Terraform Enterprise Console**: Ensure access to a Terraform Enterprise console to enable you to provide a user or team token that authorizes Prisma Cloud to access workspaces and helps regulate run configurations in the Terraform console
* **Terraform Enterprise version compatibility**: Ensure Run Tasks for workspaces on Terraform Enterprise is compatible with version 1.1.9 and above
* **Terraform Enterprise user or team permission**: For a workspace integration of run tasks you need to ensure that the token used has thehttps\://developer.hashicorp.com/terraform/enterprise/users-teams-organizations/permissions#organization-permissions\[Manage Run Tasks permissions]. The token must have the **Manage run tasks** permission at the organization level, and either: **Manage Workspaces** permissions at the organization level or **Administrator** permissions on the workspace(s) that will be integrated. **Manage run tasks** is required to create and manage the run task in the organization, and the workspace permissions are required to attach and manage the run task on workspaces.
* Create a Terraform **Organization**.
For information on creating Terraform organizations, refer to the [Terraform documentation](https://www.terraform.io/docs/cloud/users-teams-organizations/organizations.html#create-an-organization).
* Create a Terraform **Workspace**.
For information on creating Terraform workspaces, refer to the [Terraform documentation](https://developer.hashicorp.com/terraform/cloud-docs/workspaces#creating-workspaces).
2. On the Prisma Cloud Application Security console.
1. In Application Security, select **Home** > **Settings** > **Connect Provider** > **Code & Build Providers**.
2. Select **Terraform Enterprise (Run Tasks)** (under CI/CD Runs) in the catalog that is displayed.
The **Configure Account** step of the integration wizard is displayed.
3. Fill in the provided fields:
* Add your Terraform **User or Team token** in the provided field
* Add your **Domain**.
Ensure that your IP address and your Terraform Enterprise URL are on the allow list for Prisma Cloud. For more about the allow list see [allow list](/content-collections/get-started/console-prerequisites.md).
4. Select **Next**.
The **Select Organization** step of the integration wizard is displayed.
3. Select a Terraform organization from the menu to establish webhook integrations with Prisma Cloud for Terraform > **Next**.
The **Select Workspace** step of the integration wizard is displayed.
4. In the **Select Workspace** step.
1. Select a Terraform workspace to scan during the Terraform Enterprise run lifecycle.
You can select multiple workspaces for Prisma Cloud to scan during the Terraform Cloud run lifecycle. Each integration can only be associated with a single Terraform Cloud organization at any given time. However, you can create multiple integrations with multiple Terraform Enterprise organizations from a single Prisma Cloud account.
2. Select an option from the **Run Stage** list:
* **Post-plan**: The scan runs after Terraform generates the plan
* **Pre-plan**: The scan runs before Terraform generates the plan
Prisma Cloud performs a scan of Terraform templates on selected workspaces based on the Run Stage.
3. Select **Next**.
The **Status** step of the integration wizard opens, displaying an integration status message.
5. Select **Done**.
On completing the integration, an event hook is created in the Terraform organization to receive run task notifications on Prisma Cloud.
6. Verify integration: In **Application Security**, select **Home** > **Settings** > **CI/CD Runs** tab.
Your integrated Terraform repositories will be displayed.
A Terraform Enterprise run may fail if a Run Task configuration for a workspace is set at **Mandatory.** You can re-configure the severity level using [Enforcement](/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md).
7. Next step: Monitor and manage scan results.
Following the integration, the subsequent Terraform scan will automatically incorporate the selected repositories.
To view scan results and resolve issues, select **Application Security** > **Projects** > **CI/CD Runs** tab. See [Monitor Code Build Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-code-build-issues.md) for more information.
## Manage Integrations
You can view, modify, delete and add integrations. Additionally, it’s important to regularly rotate integration tokens for security purposes.
### Access Integration Management
To access integration management, in **Application Security**, select **Settings** > **Connect Provider** > **Code & Build Providers** > **Terraform Enterprise (Run Tasks)** (under CI/CD Runs).
The **Terraform Cloud Run Tasks** popup opens, displaying a list of configured accounts.
### Modify Integrations
Modify existing integrations by choosing an alternative workspace.
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an account.
3. Click **Reselect workspaces**.
The **Select Workspace** step of the integration wizard is displayed.
4. Select a workspace and complete the remaining steps in the integration wizard.
### Add Integrations
Add additional integrations as needed to expand your workflow.
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an account.
3. Select **Add an account**.
The **Configure Account** step of the integration wizard is displayed.
4. Repeat the integration process above.
### View Integrations
View a list of integrations on a single console.
1. [Access Integration Management](#access-management).
The **Terraform Cloud Run Tasks** popup displays a list of integrations,including their domain name, organization and workspace.
### Delete Integrations
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an organization.
3. Click **Delete integration**.
If you have a single integration within the account, deleting the existing integration will delete the account configuration on Prisma Cloud console.
## Secure Communication with Transporter for Terraform Enterprise (Run Tasks)
The Transporter serves as a communication proxy or broker, facilitating a secure channel between Prisma Cloud and Terraform Enterprise (Run Tasks). This enables seamless integration and management of Terraform Enterprise within your infrastructure while maintaining stringent security measures. For more information on integrating Terraform Enterprise (Run Tasks) with Transporter, refer to the [Transporter](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/manage-network-tunnel/manage-network-tunnel.md) documentation.
## Rotate Integration Tokens
Rotate integration tokens to enhance security and prevent unauthorized access.
Create a **PUT** request: `PUT /code/api/v1/integration/token/` with the following body:
```json
{
"token": "new token"
}
```
To find your \:
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an account.
3. Click **Reselect workspaces**.
The integration ID is displayed in the URL bar on the **Select Workspace** step of the integration wizard.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-enterprise-run-tasks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.