HCP Terraform "Apply not allowed for workspaces with a VCS connection" in CI
A workspace connected to a VCS repository runs on commits and pull requests, not on CLI terraform apply. When your pipeline calls the CLI against such a workspace, HCP Terraform refuses because the run source is meant to be VCS.
What this error means
A CI step running terraform apply against an HCP Terraform workspace fails with "Error: Apply not allowed for workspaces with a VCS connection". Plans may work but the apply is blocked.
Error: Apply not allowed for workspaces with a VCS connection
A workspace that is connected to a VCS requires the VCS-driven workflow to
ensure that the VCS remains the single source of truth.Common causes
The workspace uses the VCS-driven workflow
A VCS-connected workspace expects HCP Terraform to start runs from repository events, so CLI applies are disallowed to keep VCS authoritative.
Your pipeline drives applies from the CLI
The CI job calls terraform apply directly, which conflicts with the VCS-driven model configured on that workspace.
How to fix it
Switch the workspace to CLI-driven
If you want the CLI to drive runs, remove the VCS connection so the workspace uses the CLI/API-driven workflow.
- Open the workspace settings in HCP Terraform.
- Disconnect the VCS integration (or use a CLI-driven workspace).
- Re-run your
terraform applyfrom CI.
Let VCS trigger the apply
Keep the VCS connection and let merges trigger runs; use the CLI only for plan/speculative runs, not applies.
How to prevent it
- Pick one execution model per workspace: VCS-driven or CLI/API-driven, not both.
- Document which workspaces are VCS-connected so pipelines do not apply them directly.
- Use speculative plans from CLI where VCS owns the apply.