Terraform's New Undo Button Fixes Its Scariest Failure Mode

Delete the wrong Terraform workspace and you don’t just lose a config file — you lose run history, state, and every orphaned resource’s paper trail with it. HCP Terraform’s newest release is built around not letting that happen anymore.

The Framework

This release addresses five distinct friction points in how teams operate Terraform at scale, from accidental data loss to repository sprawl to migration risk. Three matter most for teams running production infrastructure.

Workspaces and Stacks Restore (GA)

Deleted workspaces and Stacks now land in a “Recoverable Items” page instead of disappearing outright, retained for 30 days and restorable to their exact prior state — run history, last known state, and configuration included — with one click. This directly targets the two failure modes that make Terraform deletions genuinely dangerous: incorrect code pushed to production, or a stray API call that removes the wrong workspace. Before this, either meant manually re-importing orphaned resources into a fresh workspace and reconstructing state by hand. The feature is available to HCP Terraform Standard and Premium customers.

Monorepo Support for Stacks (GA)

Stacks can now execute from a subdirectory rather than requiring the whole repository root, and trigger patterns let a Stack respond only to changes matching specific file patterns. Together, that means multiple independent Stacks can live in a single VCS repository without triggering each other’s runs on unrelated changes — solving both the repository-sprawl problem (one repo per Stack, multiplied across a large infrastructure estate) and the wasted-compute problem of a Stack re-running because an unrelated file changed elsewhere in the repo.

Guided CLI Migration from Workspaces to Stacks (Public Beta)

Moving from classic Workspaces to the newer Stacks model has been a manual, error-prone process. The new CLI migration tool breaks it into a modular, “toolbox” sequence practitioners can validate stage by stage, supporting incremental, manifest-driven migration across multiple workspaces rather than an all-or-nothing cutover.

Two smaller additions round out the release: project-level registry tagging (so downstream consumers can find the right module or provider version faster) and scoped policy-override permissions at the project or individual-workspace level — previously an organization-wide-only setting — letting teams delegate override authority without granting it everywhere at once.

Where It Doesn’t Apply

Restore’s 30-day retention window is a real constraint, not a permanent safety net — it protects against operational mistakes caught reasonably quickly, not long-forgotten deletions discovered months later. And the Stacks migration tool being in public beta means teams should expect rough edges before it’s the default path off classic Workspaces.

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.