Skip to main content
Before migrating, the TFC migration wizard checks your selected workspaces for issues that need resolution. It tells you exactly what needs attention. If no issues are found, you skip directly to review. The Next button stays disabled until every issue is either resolved or explicitly skipped. The registry token warning does not block it.

Issue types

Missing secrets

TFC marks sensitive variables as write-only, so their values cannot be read during the scan. You need to re-enter these values before migration. Missing secrets appear in two places:
  • Workspace variables - sensitive variables defined on individual workspaces
  • Variable set variables - sensitive variables defined in variable sets shared across workspaces. Each variable set card shows a badge listing every workspace that uses it, so you can see the full scope before deciding how to handle it.
1

Click on a workspace or variable set card

The card expands to show all sensitive variables that need values.
2

Enter the secret values

Provide the current value for each sensitive variable.
3

Click Save Secrets

The card updates to reflect the resolved status.
Resolve missing secrets and VCS connections
Skipping a secret removes it from the migrated environment. Use Skip for now only for variables that are no longer needed. Any deployment that depends on a skipped variable will fail until the value is added manually to the environment after migration.

VCS connection required

Some workspaces reference VCS repositories through providers not yet connected in env zero. The wizard groups these issues by provider type and shows the repository name (org/repo) for each affected workspace. For each provider, click the Connect button (for example, Connect GitHub). This opens an OAuth flow directly in the wizard. Once authenticated, all workspaces using that provider are unblocked at once.
Workspaces using VCS providers not supported by env zero are excluded at the workspace selection step and do not appear here.

Registry token not set

TFC injects a registry token into its own runs, so there is no variable for migration to copy. env zero runs need the TF_TOKEN_app_terraform_io environment variable to fetch modules from your TFC private registry. Without it, tofu init fails with a 401 from app.terraform.io. Workspaces on a Terraform version below 1.6.0 migrate as Terraform, so their terraform init fails the same way. The wizard lists a selected workspace here when both of the following are true:
  • Your TFC organization has at least one private registry module. The wizard checks this during the scan, and does not check which modules each workspace uses. If the migration token cannot read the registry, the wizard cannot detect private modules and shows no warning.
  • The workspace has no TF_TOKEN_app_terraform_io environment variable, directly or through a linked variable set.
This warning does not block the wizard. Set the token before you click Create in env zero, in one of these ways:
  • In TFC, add TF_TOKEN_app_terraform_io as a sensitive environment variable on the workspace or a variable set. Then go back to the Select Scope step and click Re-scan. The variable then appears under missing secrets, where you enter its value.
  • In env zero, add it as a sensitive environment variable at the organization level, or in a variable set assigned to the organization.
Use a TFC user or team API token that can read the private registry. Environment variable credentials need Terraform 1.2 or later, or OpenTofu. For what happens if you set it after migration, see Set the registry token for private modules.

No issues found

If all selected workspaces pass validation, the wizard displays a success message and you can proceed directly to the next step.

Next steps