> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-run-tasks.md).
# Terraform Cloud (Run Tasks)
Integrate Prisma Cloud with Terraform Cloud (Run Tasks) to allow dynamic, automated, and context-specific scans in your Terraform workspace.
With the integration of Terraform Cloud, Prisma Cloud, scans your Terraform frameworks to identify misconfigurations based on Prisma Cloud’s default policies, as well as custom policies created by your organization for specific needs. This scanning process occurs whenever changes are pushed or triggered in your workflow, ensuring security checks are integrated seamlessly. Prisma Cloud identifies issues such as misconfigurations in your infrastructure-as-code (IaC) files, software composition analysis (SCA) vulnerabilities\*, exposed secrets, and license non-compliance as soon as they are introduced.
\*Prisma Cloud performs 'Image Referencer' scans to analyze the contents, dependencies, and configurations of container images in order to detect known vulnerabilities, as full SCA scans are not supported for Terraform Cloud (Run Tasks).
Runs in Terraform are performed within a workspace, or a working directory when running Terraform locally. The workspace provides providing the configuration, state, and variables for the run. Terraform Enterprise maintains a run queue, processing runs sequentially. Each run progresses through multiple run stages; pending, plan, cost estimation, policy check, apply, and completion.
Users can monitor the run status (pass/fail) and remediate issues directly on the Prisma Cloud console. Prisma Cloud offers automated shift-left actions such as notifying developers or creating tickets, based on scan results. In addition, you can track the run status on Terraform Enterprise through streamlined run task reviews, which offer detailed descriptions of violations and fixes provided by Prisma Cloud within their Terraform deployment environment. For more information about streamlined tasks, refer to .
The following integration includes workflows involving third party tools such as Terraform and GitHub. These are general guidelines only, intended to help you. You must always follow the official third party documentation.
1. Before you begin.
* Procure a license for Prisma Cloud that includes the Application Security module
* Procure a [Terraform cloud license](https://www.hashicorp.com/products/terraform/pricing) that is either a trial license or a TF Cloud license at the TEAM & GOVERNANCE level
* **Permissions**: Grant the user or team the following permissions: **Manage run tasks** permission at the organization level, and either: **Manage Workspaces** permissions at the organization level or **Administrator** permissions on the workspace(s) that will be integrated. **Manage run tasks** is required to create and manage the run task in the organization, and the workspace permissions are required to attach and manage the run task on workspaces.
* Create a Terraform **Organization**.
For information on creating Terraform organizations, refer to the [Terraform documentation](https://www.terraform.io/docs/cloud/users-teams-organizations/organizations.html#create-an-organization).
* Create a Terraform **Workspace**.
For information on creating Terraform workspaces, refer to the [Terraform documentation](https://developer.hashicorp.com/terraform/cloud-docs/workspaces#creating-workspaces).
2. On **Terraform Cloud**, create a Terraform **api token** for your user.
1. Select your user/profile icon > **User Settings**.
2. Select the **Tokens** section from the left side menu.
3. Click **Create an API token** and provide a description > Select **Create API token**.
4. Copy and save the token > **Done**.
Skip this step if you plan on using an existing token.
3. On the Prisma Cloud Application Security console.
1. In **Application Security**, select **Home** > **Settings** > **Connect Provider** > **Code & Build Providers**.
2. Select **Terraform Cloud (Run Tasks)** (under CI/CD Runs) in the catalog that is displayed.
The **Configure Account** step of the integration wizard is displayed.
4. Provide your Terraform 'User' or 'Team' token generated in step 1 above > **Next**.
The **Select Organization** step of the integration wizard is displayed.
5. Select a Terraform organization from the menu to establish webhook integrations with Prisma Cloud for Terraform > **Next**.
The **Select Workspace** step of the integration wizard is displayed.
6. Select a Terraform workspace to scan during the Terraform Cloud run lifecycle.
You can select multiple workspaces for Prisma Cloud to scan during the Terraform Cloud run lifecycle. Each integration can only be associated with a single Terraform Cloud organization at any given time. However, you can create multiple integrations with multiple Terraform Enterprise organizations from a single Prisma Cloud account.
7. Select an option from the **Run Stage** list:
* **Post-plan**: The scan runs after Terraform generates the plan
* **Pre-plan**: The scan runs before Terraform generates the plan
Prisma Cloud performs a scan of Terraform templates on selected workspaces based on the Run Stage.
8. Select **Next**.
The **Status** step of the integration wizard opens, displaying an integration status message.
9. Select **Done**.
On completing the integration, an event hook is created in the Terraform organization to receive run task notifications on Prisma Cloud.
10. Verify integration: In **Application Security**, select **Home** > **Settings** > **CI/CD Runs** tab.
Your integrated Terraform repositories will be displayed.
A Terraform Enterprise run may fail if a Run Task configuration for a workspace is set at **Mandatory.** You can re-configure the severity level using [Enforcement](/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md).
11. Next step: Monitor and manage scan results.
Following the integration, the subsequent Terraform scan will automatically incorporate the selected repositories.
To view scan results and resolve issues, select **Application Security** > **Projects** > **CI/CD Runs** tab. Refer to [Monitor Code Build Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-code-build-issues.md) for more information.
## Manage Integrations
You can view, modify, delete and add integrations. Additionally, it’s important to regularly rotate integration tokens for security purposes.
### Access Integration Management
To access integration management, in **Application Security**, select **Settings** > **Connect Provider** > **Code & Build Providers** > **Terraform Cloud (Run Tasks)** (under CI/CD Runs).
The **Terraform Cloud Run Tasks** popup opens, displaying a list of configured accounts.
### Modify Integrations
Modify existing integrations by choosing an alternative workspace.
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an account.
3. Click **Reselect workspaces**.
The **Select Workspace** step of the integration wizard is displayed.
4. Select a workspace and complete the remaining steps in the integration wizard.
### Add Integrations
Add additional integrations as needed to expand your workflow.
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an account.
3. Select **Add an account**.
The **Configure Account** step of the integration wizard is displayed.
4. Repeat the integration process above.
### View Integrations
View a list of integrations on a single console.
1. [Access Integration Management](#access-management).
The **Terraform Cloud Run Tasks** popup displays a list of integrations, including their organization and workspace.
### Delete Integrations
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an organization.
3. Click **Delete integration**.
If you have a single integration within the account, deleting the existing integration will delete the account configuration on Prisma Cloud console.
## Rotate Integration Tokens
Rotate integration tokens to enhance security and prevent unauthorized access.
Create a **PUT** request: `PUT /code/api/v1/integration/token/` with the following body:
```json
{
"token": "new token"
}
```
To find your \:
1. [Access Integration Management](#access-management).
2. Select the menu under the **Actions** column of an organization account.
The integration ID is displayed in the URL bar on the **Configure Account** step of the integration wizard.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-terraform-run-tasks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.