Terraform Cloud plan has changes but auto-apply is disabled in CI

By Daniel Zoghalchali·Latchkey

The remote run produced a plan with changes, but the workspace has auto-apply disabled. HCP Terraform holds the run in a "needs confirmation" state, so an unattended CI job that expected apply to finish stalls or exits without applying.

What this error means

A CLI-driven run plans successfully, reports changes, and then waits: the CI step reports the run is awaiting confirmation and does not proceed to apply.

Run pending. Waiting for manual confirmation before applying.
To apply this run, confirm it in HCP Terraform or run with -auto-approve
on a workspace that permits it.

Common causes

Auto-apply is off on the workspace

With auto-apply disabled, every run pauses for a human to confirm before it applies, which unattended CI cannot do.

apply ran without -auto-approve

A CLI-driven apply without -auto-approve also waits for interactive confirmation that CI never provides.

How to fix it

Auto-approve CLI-driven applies

1. For CLI-driven workspaces, pass -auto-approve to the apply.
2. Ensure the token/team is permitted to apply the workspace.
3. Re-run so the plan applies without a prompt.

terraform apply -auto-approve

Or enable auto-apply on the workspace

Turn on auto-apply in workspace settings so approved plans apply automatically after a successful plan.

# HCP Terraform: Workspace > Settings > General > Auto-apply

How to prevent it

• Decide per workspace whether CI applies automatically or waits for review.
• Use -auto-approve only where unattended apply is intended.
• Keep apply permissions scoped to the CI principal.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation