Terraform Workspace Selection Remote Auditor

The Incident (What Does the Error Mean?)

Raw error output you'll see in the terminal:

$ terraform workspace select production
Error: no workspace named "production"

For more help on this command, run:
  terraform workspace --help

Or, when using the remote backend with a prefix:

$ terraform init && terraform plan
╷
│ Error: No workspaces found
│
│ The configured working directory does not appear to be part of a Terraform
│ Cloud workspace. The 'remote' backend is configured with workspace prefix
│ "app-" but no workspaces with that prefix exist in organization "acme-corp".
╵

Immediate consequence: Every terraform plan, terraform apply, and terraform workspace select call is dead. No state can be read or written. If this is a CI/CD pipeline, every deployment job is now failing. If this is a terraform destroy run in an incident, you cannot execute it.

The Attack Vector / Blast Radius

This is not a transient network error. This is a hard configuration mismatch between your local Terraform code and the remote backend state. The blast radius breaks down into three failure modes:

1. Wrong organization slug: Your backend "remote" block references organization = "acme-corp" but your TFE token is scoped to acme-corp-prod. Every workspace lookup returns 404. All teams sharing this root module are blocked.

2. Workspace was never created: The workspace production was deleted from TFE UI, or it was never provisioned. Terraform Cloud does not auto-create workspaces on workspace select — unlike local backend. Engineers who migrated from local backend assume this works identically. It does not.

3. Prefix/name collision: Using workspaces { prefix = "app-" } means Terraform strips the prefix locally. Running terraform workspace select staging maps to TFE workspace app-staging. If someone created staging (no prefix) in TFE instead of app-staging, the workspace is permanently invisible to this backend config. State is orphaned.

The secondary risk: If a developer works around this by re-running terraform init -reconfigure pointing at a different backend, they risk creating split-brain state — two backends both believing they own the same infrastructure. This causes duplicate resource creation or terraform apply destroying resources managed by the other state file.

Prevention in CI/CD

This class of error should never reach a pipeline run. Gate it earlier:

1. Pre-flight Workspace Existence Check (Shell)

Add this to your CI job before terraform init:

#!/bin/bash
WORKSPACE_NAME="${TF_WORKSPACE:-production}"
ORG="acme-corp-prod"

HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  --header "Authorization: Bearer $TFE_TOKEN" \
  "https://app.terraform.io/api/v2/organizations/${ORG}/workspaces/${WORKSPACE_NAME}")

if [ "$HTTP_STATUS" != "200" ]; then
  echo "[FATAL] Workspace '${WORKSPACE_NAME}' not found in org '${ORG}'. HTTP ${HTTP_STATUS}. Aborting."
  exit 1
fi

2. Checkov Policy (Static Analysis)

Checkov check CKV_TF_1 enforces that modules use pinned sources, but for backend validation use terraform validate combined with a custom Checkov policy:

# In your CI pipeline
checkov -d . --check CKV_TF_1 --framework terraform
terraform init -backend=false  # syntax check without hitting TFE
terraform validate

3. OPA/Conftest Policy for Backend Block Enforcement

# policy/terraform_backend.rego
package terraform.backend

deny[msg] {
  backend := input.terraform[_].backend[_].remote[_]
  not backend.organization
  msg := "Remote backend block must specify an organization."
}

deny[msg] {
  backend := input.terraform[_].backend[_].remote[_]
  workspace := backend.workspaces[_]
  not workspace.name
  not workspace.prefix
  msg := "Remote backend workspaces block must specify either 'name' or 'prefix'."
}

conftest test main.tf --policy policy/

4. Terraform Cloud Workspace-as-Code (VCS-Driven)

Stop creating workspaces manually. Use the tfe provider to declare workspaces as code:

resource "tfe_workspace" "production" {
  name         = "production"
  organization = "acme-corp-prod"
  tag_names    = ["env:production", "team:platform"]
  
  vcs_repo {
    identifier     = "acme-corp/infra"
    oauth_token_id = var.oauth_token_id
    branch         = "main"
  }
}

If the workspace doesn't exist as a resource in this config, it doesn't get created. No more drift between code and TFE state.