CLI Workspaces

Scenario: An engineer thinks a workspace is a directory or branch, then applies production values while the default workspace is selected.

CLI workspaces are multiple state instances for the same configuration and backend. terraform.workspace exposes the selected name. Commands include workspace list, new, select, show, and delete. Workspaces are useful for parallel ephemeral copies with the same topology, but the selection is ambient context and easy to overlook. They do not create strong account, credential, or backend isolation by themselves.

Analogy: Workspaces are tabs in one workbook: each tab has different values, but the formulas and file permissions are shared.

A worked configuration

terraform workspace new dev
terraform workspace select prod
terraform workspace show

locals { name = "api-${terraform.workspace}" }

Put the selected workspace in prompts and CI logs, prohibit local production applies, and validate allowed combinations. Never let terraform.workspace become a maze of conditionals that produces unrelated architectures.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-workspace-environments Terraform lab. Open /labs/terraform and choose slug tf-workspace-environments; the lab runs real Terraform against the offline FakeCloud provider.