Terraform Workspaces & Multi-Environment

1# List all workspaces (* marks the currently active one)
2terraform workspace list
3# Output:
4# * default
5#   dev
6#   staging
7#   prod
8
9# Show current workspace name
10terraform workspace show
11# Output: prod
12
13# Create a new workspace (and switch to it)
14terraform workspace new dev
15terraform workspace new staging
16terraform workspace new prod
17
18# Switch to an existing workspace
19terraform workspace select prod
20terraform workspace select default
21
22# Delete a workspace (must have empty state — no resources)
23terraform workspace delete dev
24
25# Create without switching (Terraform >= 1.1)
26terraform workspace new --no-color uat

1terraform workspace show   # → default
2terraform workspace list   # → * default

1# Local state directory structure after creating dev and prod workspaces:
2.
3├── terraform.tfstate           ← default workspace
4├── terraform.tfstate.d/
5│   ├── dev/
6│   │   └── terraform.tfstate  ← dev workspace
7│   └── prod/
8│       └── terraform.tfstate  ← prod workspace

1# Simple conditional on resource size
2resource "aws_instance" "web" {
3  ami           = data.aws_ami.ubuntu.id
4  instance_type = terraform.workspace == "prod" ? "t3.large" : "t3.micro"
5
6  tags = {
7    Name        = "${terraform.workspace}-web-server"
8    Environment = terraform.workspace
9  }
10}
11
12# Conditional resource count
13resource "aws_instance" "web" {
14  count         = terraform.workspace == "prod" ? 3 : 1
15  instance_type = "t3.micro"
16}
17
18# Using workspace in naming to avoid conflicts
19resource "aws_s3_bucket" "app" {
20  bucket = "my-app-${terraform.workspace}-data"
21  # dev   → my-app-dev-data
22  # prod  → my-app-prod-data
23}

1locals {
2  # Define all environment-specific values in one place
3  env_config = {
4    default = {
5      instance_type  = "t3.micro"
6      instance_count = 1
7      db_class       = "db.t3.micro"
8      multi_az       = false
9    }
10    dev = {
11      instance_type  = "t3.micro"
12      instance_count = 1
13      db_class       = "db.t3.micro"
14      multi_az       = false
15    }
16    staging = {
17      instance_type  = "t3.small"
18      instance_count = 2
19      db_class       = "db.t3.small"
20      multi_az       = false
21    }
22    prod = {
23      instance_type  = "t3.medium"
24      instance_count = 4
25      db_class       = "db.t3.medium"
26      multi_az       = true
27    }
28  }
29
30  # Look up current workspace's config (fallback to dev if unknown workspace)
31  config = lookup(local.env_config, terraform.workspace, local.env_config["dev"])
32}
33
34resource "aws_instance" "web" {
35  count         = local.config.instance_count
36  instance_type = local.config.instance_type
37}
38
39resource "aws_db_instance" "main" {
40  instance_class = local.config.db_class
41  multi_az       = local.config.multi_az
42}

1# Typical CI/CD pipeline using workspaces
2
3# Step 1: Select or create the workspace for this deployment target
4terraform workspace select prod || terraform workspace new prod
5
6# Step 2: Plan with workspace-specific var file
7terraform plan -var-file="environments/prod.tfvars" -out=prod.tfplan
8
9# Step 3: Apply the saved plan
10terraform apply prod.tfplan
11
12# Step 4: Show current workspace in output
13echo "Deployed to workspace: $(terraform workspace show)"

1# Feature branch workflow — ephemeral workspace per PR
2BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD | tr '/' '-')
3terraform workspace new $BRANCH_NAME || terraform workspace select $BRANCH_NAME
4terraform apply -auto-approve
5
6# After PR merge — clean up
7terraform destroy -auto-approve
8terraform workspace select default
9terraform workspace delete $BRANCH_NAME

1# Connecting to Terraform Cloud (replaces backend "s3")
2terraform {
3  cloud {
4    organization = "my-company"
5
6    workspaces {
7      name = "production-app"         # single named workspace
8      # OR
9      tags = ["app", "production"]    # all workspaces with these tags
10    }
11  }
12}

1# provider.tf — provider per AWS account
2
3# Dev account
4provider "aws" {
5  alias  = "dev"
6  region = "us-east-1"
7  assume_role {
8    role_arn = "arn:aws:iam::111111111111:role/TerraformRole"
9  }
10}
11
12# Prod account
13provider "aws" {
14  alias  = "prod"
15  region = "us-east-1"
16  assume_role {
17    role_arn = "arn:aws:iam::999999999999:role/TerraformRole"
18  }
19}

1# Backend with separate state per account+environment
2# environments/prod/backend.tf
3terraform {
4  backend "s3" {
5    bucket = "prod-account-terraform-state"
6    key    = "app/terraform.tfstate"
7    region = "us-east-1"
8    # This bucket lives in the prod AWS account
9  }
10}