Terraform Cloud "Apply not allowed for workspaces with a VCS connection" in CI

By Daniel Zoghalchali·Latchkey

The workspace is VCS-driven: HCP Terraform triggers runs from the connected repository, not from terraform apply on the CLI. A CLI-triggered apply is refused because it would bypass the VCS workflow.

What this error means

terraform apply against a Terraform Cloud workspace fails with "Error: Apply not allowed for workspaces with a VCS connection".

Error: Apply not allowed for workspaces with a VCS connection

Apply is only allowed for CLI-driven workspaces. This workspace is connected
to a VCS repository, so runs are triggered by commits.

Common causes

The workspace execution is VCS-driven

A VCS-connected workspace starts runs from repo events. CLI applies are intentionally blocked so the source of truth stays the repo.

CI expects a CLI-driven workflow

Your pipeline runs terraform apply directly, which only works when the workspace is CLI-driven or API-driven.

How to fix it

Let the VCS connection drive the run

1. Push to the connected branch and let HCP Terraform queue the run.
2. Approve the run in the UI or via auto-apply settings.
3. Do not call terraform apply from CI for this workspace.

Or switch the workspace to CLI/API-driven

If you want CI to run apply, remove the VCS connection and set the workspace to CLI-driven (or API-driven) execution.

# In HCP Terraform: Workspace > Settings > Version Control
# Remove the VCS connection to allow CLI-driven runs.

How to prevent it

• Decide VCS-driven vs CLI/API-driven per workspace and keep CI aligned.
• Do not mix a VCS connection with CLI applies from a pipeline.
• Document each workspace execution mode so runs land in one place.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation