Documentation · Infrastructure runs
Security of infrastructure runs
Where a hosted run executes, what it can reach on the network, what its credentials allow, how state is kept and backed up, and what we do not do.
Where a hosted plan or apply executes, what it can reach on the network, what its credentials allow, and how your state is kept. It also says what we do not do, because that is the half a security review needs most.
Each plan and each apply executes in a container of its own on Google Cloud Run, in Google's europe-west1 region in Belgium. A container runs one plan or one apply, for one run, and is not used again. Nothing a run leaves in its container reaches another run. The engine is OpenTofu, as the engine that executes your runs explains.
A run can reach the internet. Providers call your cloud's APIs, your own services and anything else your configuration names, so outbound connections are not limited to a list.
Outbound connections are logged. The network a run uses records where its connections went and how much they carried, never what they carried. Google Cloud samples that log, so it shows where runs connect rather than guaranteeing that every short connection appears.
A run cannot reach a private address. Connections to
10.0.0.0/8,172.16.0.0/12and192.168.0.0/16are refused, so a run cannot reach another run. That also means a hosted run cannot reach a private network of yours: we offer no VPN or peering into one.Nothing can open a connection to a run. Inbound connections are refused.
There is no fixed outbound address. A run's connections leave from addresses that change, so an allowlist of our addresses on your side is not something we can support today.
A run is given a credential for that run alone. It can read the workspace the run belongs to, its variables, its current state and your organisation's private modules. Only an apply can write a new state version; a plan can read the state but cannot change it. It stops working when the run's plan or apply ends.
The credential cannot reach another workspace, with one exception: it can read the state of any workspace in your organisation that has remote state sharing turned on, which is what terraform_remote_state relies on. A workspace has it off unless somebody turns it on. Nothing in another organisation is reachable at all.
The container's own Google Cloud identity may do two things: write trace data, and call the engine's API, where the run's credential decides what it may do. It holds no other permission, so a run cannot use our cloud account to reach anything of ours or another customer's.
Your cloud credentials reach a run in one of two ways. With dynamic provider credentials there is no long-lived key at all: the run is given a short-lived token, and your cloud decides what it may do. Otherwise, set the key as an environment variable on the workspace, or on a variable set, and mark it sensitive.
Every state version is kept in our database, which is in Ireland. Each one is immutable: a new apply, or a rollback, records a new version rather than changing an old one.
State is stored as OpenTofu wrote it. We do not encrypt it with a key of yours, and there is no option to bring one. It holds whatever your providers write into it, sensitive values included, so treat access to a workspace as access to those values. Turning on remote state sharing for a workspace gives those values to every run in your organisation, too.
Downloading a state version from the dashboard asks for your authenticator code if you use two-factor authentication and have not entered one in the last fifteen minutes.
The database is backed up continuously and can be restored to any point in the last seven days. That is our protection against losing the database; it is not a way to get back something you deleted. Taking your state with you says what you can recover yourself, and for how long.
No customer-managed encryption keys for state.
No private networking into your environment, and no fixed outbound address.
No way to limit a run's outbound connections to a list of your own.
No choice of region: runs execute in Belgium and state is kept in Ireland.