Does OrchestrAI apply Terraform changes automatically?

No, terraform_apply and terraform_destroy are rated critical and require a typed risk phrase after you have seen the plan. terraform_plan itself is low risk and read-only.

Can OrchestrAI work with Terraform Cloud workspaces?

It can list, create, and select workspaces and read state and outputs. It does not query Terraform Cloud's run history or manage variable sets through the API.

How does OrchestrAI authenticate to Terraform?

You add a Terraform credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it. Some Terraform operations also act on your AWS or GCP or AZURE account, which uses a short-lived OIDC-federated token instead of stored keys.

Integration · Infrastructure as code

Terraform + OrchestrAI

Catalog exported 2026-09-02 · Terraform website

Run Terraform from chat: init, plan, apply, state moves, and workspaces, with review before every apply.

OrchestrAI exposes 15 Terraform operations: 11 are low-risk (read-only or low-impact), 2 create or modify resources and run only after you confirm the plan, and 2 are destructive and require a typed risk phrase. 4 of them also carry a step-level approval gate.

15operations

11low risk

2create or modify

2destructive

4step-level approval

What teams use it for

Teams that keep infrastructure in Terraform use OrchestrAI to run a plan for a module, read the diff in the thread, and apply it after a reviewer has looked, with apply and destroy each requiring a typed risk phrase. Workspace selection and creation, reading outputs, listing and inspecting state, and formatting and validating configs are low-risk steps that make it practical to ask what the prod workspace thinks the RDS endpoint is. State moves and removals are high risk and gated. There is no import or taint operation, and Terraform Cloud run history and variable sets are not read from the API, so those remain in the Terraform Cloud UI.

Every Terraform operation, with its risk level

Terraform operations available through OrchestrAI
Operation	What it does	Risk	Step-level approval
`Terraform Format`	Format Terraform configuration files	Low risk	No
`Terraform Init`	Initialize a Terraform working directory	Low risk	No
`Terraform Output`	Read Terraform output values	Low risk	No
`Terraform Plan`	Generate a Terraform execution plan	Low risk	No
`Terraform Show`	Show Terraform state or plan	Low risk	No
`Terraform State List`	List resources in Terraform state	Low risk	No
`Terraform State Show`	Show details of a resource in state	Low risk	No
`Terraform Validate`	Validate Terraform configuration files	Low risk	No
`Terraform Workspace List`	List Terraform workspaces	Low risk	No
`Terraform Workspace New`	Create a new Terraform workspace	Low risk	No
`Terraform Workspace Select`	Select a Terraform workspace	Low risk	No
`Terraform State Move`	Move a resource in Terraform state	Modifies existing	Yes
`Terraform State Remove`	Remove a resource from Terraform state	Modifies existing	Yes
`Terraform Apply`	Apply Terraform changes to infrastructure	Destructive	Yes
`Terraform Destroy`	Destroy Terraform-managed infrastructure	Destructive	Yes

Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.

What you connect

No Terraform-specific credential; these operations run against your connected cloud account. Operations that touch your cloud account use your connected AWS or GCP or AZURE role through a short-lived token minted per run. Connected-service tokens are envelope-encrypted with a per-record key wrapped by a cloud KMS.

Prompts that work

Run terraform plan in the networking module against the prod workspace and summarize what would change
Apply the plan we just reviewed for the staging workspace
Move aws_s3_bucket.logs to module.logging.aws_s3_bucket.this in state without recreating it

Before anything runs

Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.

Frequently asked questions

Does OrchestrAI apply Terraform changes automatically?: No, terraform_apply and terraform_destroy are rated critical and require a typed risk phrase after you have seen the plan. terraform_plan itself is low risk and read-only.
Can OrchestrAI work with Terraform Cloud workspaces?: It can list, create, and select workspaces and read state and outputs. It does not query Terraform Cloud's run history or manage variable sets through the API.
How does OrchestrAI authenticate to Terraform?: You add a Terraform credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it. Some Terraform operations also act on your AWS or GCP or AZURE account, which uses a short-lived OIDC-federated token instead of stored keys.

Related integrations

AnsibleInfrastructure as code Argo CDGitOps HelmKubernetes

Try it on your own account

Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.

Start for $5

Unused credits refunded in your first 14 days.