Running remote plan

Run terraform plan locally while executing remotely on env zero with shared state, RBAC, cost estimation, and custom flows, with auditable results.

Remote Plan

Remote Backend allows running your Terraform plan locally by triggering a remote plan in env zero.
The remote plan uses your local Terraform files but actually runs it remotely in env zero while using the shared state and variables set for the env zero environment. Each remote plan creates a deployment in env zero so you will have an audit for each deployment.
By running a remote plan you can build your IaC faster, and test your changes locally before committing them.

Additional benefits are the rest of the env zero features that are automatically integrated into your plan logs. It includes:

• Role Based Access
• Custom Flows
• Cost Estimation
• Variables and Secrets
• Policies
• Plugins

Save a plan and apply it later

Save a remote plan to a file, inspect it, and apply exactly that plan without planning again.

Saving and showing a plan requires the Run Plan permission. Applying it requires the Run Apply permission.

Requirements:

• OpenTofu 1.6 or later, or Terraform 1.6 or later
• The cloud block configuration from Authenticate locally. The backend "remote" configuration can’t save plans.
• Self-hosted agents: v5.1.0 or later

OpenTofu

tofu plan -out=<PLAN_FILE>
tofu show <PLAN_FILE>
tofu show -json <PLAN_FILE>
tofu apply <PLAN_FILE>

The plan runs as a remote plan deployment. The apply runs as a separate deployment, or as a destroy if you planned with -destroy. Running apply with the plan file is the confirmation, so the apply deployment does not wait for approval in env zero.

The output of show -json includes the values of sensitive variables and outputs in plain text. Treat the output as a secret.

Limitations:

• Apply a saved plan within 1 day of creating it.
• Each saved plan can be applied once. Applying it again fails.
• You can apply only a plan that succeeded.
• Workflow sub-environments do not support saved plans.

.terraformignore

If cases where your gitrepo is particularly large, this will cause the remote plan to take a longer time to process (due to compressing and decompressing the gitrepo). You can save time on the remote plan by adding a .terraformignore to the root of the repo.

/**
!my-working-dir/
my-working-dir/.terraform
my-working-dir/.terraform/**

ignore the local .terraform folder

If you have a local .terraform folder, please add it to the ignore list (like in the example above), otherwise you may get some errors such as workspace not supported

Auditing

env zero UI can show you each remote plan deployment that has occurred, accesses its plan logs, and gives you visibility and audit on who actually trigged it from their local environment.

Local Executions

If you still wish to run a plan or apply locally, without a remote execution by env zero - you can do it by enabling terraform’s TF_FORCE_LOCAL_BACKEND environment variable.

TF_FORCE_LOCAL_BACKEND=1 terraform apply

Local Execution

When running plan or apply locally, those deployments are not audited in env zero and RBAC and policy control are not enforced. In addition since the code you are running is not commited, we can’t attach that deployment to a certain commit or a branch.

You should avoid using Local Execution as much as possible.

Next steps

When the plan output looks right, run a remote apply to deploy the change from your terminal.