How do you run Terraform safely in CI/CD?

Question

Accepted Answer

The model mirrors application CI/CD with infra-specific safeguards. On a pull request, the pipeline runs terraform plan and posts the diff into the PR, so a reviewer sees exactly what will change and approves it before anything happens, that is the review gate, and itself catches dangerous destroys. After approval and merge to main, the pipeline runs terraform apply, ideally applying the exact plan artifact that was reviewed, so what gets applied is precisely what was approved, and every apply is automated, logged, and traceable to a commit and an author. Underneath, CI uses the shared remote backend with state locking, so a pipeline run and a human, or two pipeline runs, can never apply concurrently and corrupt the state. Then the guardrails that make it genuinely safe: policy-as-code, OPA or Sentinel, to enforce rules like no public S3 buckets or only approved instance types, and security scanning like tfsec or checkov, both as gates that can fail the build. And critically, the pipeline authenticates with short-lived, least-privilege credentials via OIDC federation rather than long-lived cloud keys stored in CI, so there is no standing powerful credential to leak. The contrast with running apply from a laptop is that this gives review, audit, locking, policy enforcement, and no static admin keys, which is what you need for infrastructure changes.

Answer

Why run plan on the PR rather than only applying on merge?

So reviewers see the exact diff (including destroys/replaces) and approve before any change happens, the infra code-review gate. Applying the saved plan on merge then guarantees what runs is exactly what was reviewed.

Answer

How should the CI pipeline authenticate to the cloud?

Short-lived credentials via OIDC federation (the CI provider issues a token the cloud trusts to assume a scoped role), not long-lived access keys stored in CI settings. No standing credential to leak.

How do you run Terraform safely in CI/CD?

How do you run Terraform safely in CI/CD?

The follow-ups they ask next

What the interviewer is listening for

What sinks the answer

If you genuinely do not know

Keep going with iac & automation

Knowing the answer is not the same as recalling it under pressure