Terraform MCP server is now generally available. Terraform MCP server 1.0 ensures consistent infrastructure across your organization with flexible deployment options. Terraform MCP server enables AI assistants like GitHub Copilot, IBM Bob, Claude Code etc. to interact with Terraform through the Model Context Protocol (MCP). By connecting AI to your infrastructure workflows, teams reduce manual effort, eliminate context switching between tools, and accelerate delivery without compromising security. Today, HashiCorp is announcing the general availability of Terraform MCP server, now available for both HCP Terraform and Terraform Enterprise. This represents a milestone shaped by customer and community feedback since HashiCorp first announced Terraform MCP server last year. In this post, HashiCorp'll explore how Terraform MCP server improves infrastructure team productivity through AI-assisted workflows, maintains security by design, and provides flexible deployment options for teams of any size. Accelerate infrastructure workflows with AI. Teams previously spent significant time on repetitive tasks: searching documentation, interpreting plan files, and auditing configurations. Terraform MCP server shifts this burden to AI assistants, allowing engineers to focus on strategic work rather than routine operations. Generate code using your organization's standards. Before, engineers manually searched private registries for approved modules, copied examples, and verified compliance with organizational policies. This process was time-consuming and error-prone, often resulting in inconsistent infrastructure patterns across teams. Now, AI assistants can connect directly to your Terraform or Terraform Enterprise private registry. They discover approved modules, understand your organization's patterns, and generate compliant code automatically. This eliminates the need to manually search modules and ensures consistent infrastructure across your organization, reducing both development time and compliance risk. Access Terraform workspace data and configurations. Managing infrastructure across multiple workspaces requires constant context switching between tools and interfaces. Traditionally, engineers navigate through web UIs or CLI commands to gather information about workspace configurations and variables, a fragmented workflow that slows down troubleshooting and decision-making. Terraform MCP server provides AI assistants with direct access to workspace data and configurations. Users can ask questions like "Which workspaces haven't been updated in 90 days?" or "Show me workspaces managing more than 1,000 resources," and receive immediate answers. This unified access eliminates context switching, enabling teams to gain faster insights and make informed decisions without leaving their development environment. Understand plan changes with context. Terraform plan output can be difficult to interpret, especially for complex infrastructure changes. Engineers have traditionally spent time manually parsing plan files, tracing resource dependencies, and assessing the impact of modifications before approval. Terraform MCP server now enables AI assistants to analyze plan details and explain changes in natural language. This reduces the risk of misinterpreting plans and speeds up code review cycles, helping teams move faster while maintaining confidence in their infrastructure changes. Security by design. For infrastructure teams, security is non-negotiable. Terraform MCP server acts as a controlled interface that enforces your existing Terraform authentication and authorization. AI assistants receive only the specific information needed to answer questions, and not the credentials or sensitive data, reducing the risk of exposure while maintaining the security boundaries you've already established. The server includes CORS policies, rate limiting, and OpenTelemetry integration for monitoring and security auditing. Flexible deployment options. Terraform MCP server supports deployment modes that fit how your team works. For individual developers, local execution provides the fastest setup and keeps all data on your machine, ideal for personal development and testing. For teams requiring centralized management, the server can be deployed as a shared service that team members access remotely while maintaining individual access controls through their own Terraform tokens. Both deployment modes enforce the same authentication model, credentials remain in the deployment environment, while AI assistants receive only necessary metadata and configuration data needed to respond to queries. Get started with Terraform MCP server. Terraform MCP server works with multiple AI assistants, including IBM Bob, Claude Desktop, GitHub Copilot, and other MCP-compatible tools. To get started: · Read the documentation on setting up the MCP server. · View the private registry tutorial · Go to the GitHub repo New to Terraform? Sign up for an HCP account to get started today and check out its tutorials. HCP Terraform includes a $500 credit that allows users to quickly get started using features from any plan, including HCP Terraform Premium. Contact its sales team if you're interested in trying its self-managed offering: Terraform Enterprise.

HCP Packer adds enforced provisioners. HCP Packer now supports enforced provisioners, enabling platform and security teams to centrally apply mandatory provisioning steps across image builds. Organizations increasingly rely on golden images (such as AMIs, virtual machines, Docker containers, and more) to standardize infrastructure across hybrid-cloud environments. As image usage becomes more distributed across the enterprise, platform and security teams need mechanisms to ensure security requirements remain intact throughout the image lifecycle - without introducing additional complexity for downstream consumers. Today, HashiCorp is excited to announce enforced provisioners for HCP Packer. This new capability enables organizations to centrally define and apply mandatory provisioning logic across image builds, helping teams maintain security, compliance, and operational standards as images are consumed across the organization. Image governance in HCP Packer. HCP Packer helps organizations create, manage, and govern trusted images at scale across hybrid cloud environments. In many organizations, image ownership often spans multiple teams. While a platform team may create and harden a base image, downstream application teams build additional layers on top to meet their own requirements. While this model provides flexibility, it can also introduce governance challenges. Security teams need confidence that hardening configurations, compliance controls, and required software components remain intact as images move through the organization. Without centralized enforcement, downstream image builds can unintentionally modify or remove security standards, increasing risk and creating operational inconsistencies across environments. Platform and security teams need a way to ensure required provisioning steps are applied automatically, regardless of who is building the image or where it is being built. Introducing enforced provisioners. To address these challenges, HashiCorp is excited to introduce enforced provisioners in HCP Packer. Enforced provisioners allow platform and security teams to centrally define mandatory provisioning logic and apply it across image builds associated with a Packer bucket. Teams can upload and manage provisioner definitions through the HCP Packer UI or API, then link those provisioners to specific image buckets. During every downstream image build, HCP Packer automatically retrieves and executes the configured provisioners, ensuring required standards are consistently applied throughout the image provisioning process. In addition, HCP Packer tracks the version of enforced provisioners used for each image version, providing visibility into the applied controls applied and supporting compliance and auditing efforts. For organizations managing secure image pipelines, enforced provisioners provide a centralized mechanism to maintain image standards while preserving flexibility for downstream teams to customize images for their own workloads. Benefits. By extending provisioning enforcement directly into the image build process, organizations can scale image standardization while reducing operational overhead: Improve security and compliance - Platform and security teams can ensure critical compliance checks are automatically applied across image builds, reducing the risk of security standards being bypassed. Reduce operational overhead - Centralized management of provisioning logic eliminates the need for individual teams to manually replicate security and compliance configurations across image templates, helping organizations scale image governance more efficiently. Increase visibility and auditability - Tracking enforced provisioner versions alongside image versions provides a clear record of which controls were applied to the image, helping teams support compliance and operational investigations. Next steps. Enforced provisioners are now available in HCP Packer. To learn more, please refer to the HCP Packer provisioners documentation. New to HCP Packer? Get started for free and see the benefits of a centralized artifact registry in action.

IBM Vault Enterprise 2.0 brings automated LDAP secrets management to enterprise identity security. * Craig Risi Software Architect | Game Designer| Writer | Speaker Write for InfoQ. Feed your curiosity. Help 550k+ global senior developers each month stay ahead. Get in touch IBM and HashiCorp have announced new LDAP secrets management capabilities in IBM Vault Enterprise 2.0, introducing a redesigned architecture to manage LDAP credentials, support password rotation, and automate the identity lifecycle. The update integrates LDAP static roles into Vault's centralized rotation framework, allowing organizations to automate credential management while reducing reliance on privileged administrative accounts. The announcement also reflects the continuing integration of HashiCorp's portfolio into IBM following IBM's acquisition of the company in 2025. While the product remains the well-established HashiCorp Vault platform familiar to infrastructure and security teams, IBM Vault Enterprise 2.0 represents the next stage of that evolution under IBM ownership. For existing Vault users, the release signals continuity rather than disruption, with IBM continuing to invest in Vault';s core strengths around secrets management, identity security, and infrastructure automation while integrating the technology more closely into its broader enterprise security strategy. The release addresses a long-standing challenge for enterprises that continue to rely on LDAP-based identity systems such as Active Directory, OpenLDAP, and RACF. While LDAP remains a foundational component of enterprise authentication and authorization, managing service account passwords, credential rotation schedules, and lifecycle controls has often required significant manual effort and operational oversight. Vault Enterprise 2.0 aims to reduce that burden through centralized automation, configurable rotation policies, and improved operational controls. A key enhancement is the migration of LDAP static roles into Vault's centralized rotation manager. Previously, LDAP credential rotation was handled through plugin-specific mechanisms, limiting operational visibility and flexibility. Under the new architecture, administrators gain access to standardized scheduling, retry logic, pause-and-resume controls, and centralized governance for credential rotation activities. The platform also introduces support for defining an initial password when onboarding LDAP accounts into Vault. This allows Vault to become the authoritative source of credential management from the start of an account's lifecycle, helping organizations establish clearer ownership and auditability for identity-related operations. Perhaps the most significant architectural change is the introduction of a "self-managed flow" model. Rather than relying on a highly privileged administrative account to rotate credentials across an entire directory, individual LDAP accounts can now authenticate and rotate their own passwords under controlled policies. This approach aligns with the principle of least privilege, a foundational security practice that seeks to minimize the impact of credential compromise by limiting access rights wherever possible. The result is a more decentralized model for secrets management that reduces the operational and security risks associated with maintaining high-privilege service accounts. Organizations can automate password rotation more frequently while limiting the blast radius of any single credential compromise. For existing Vault customers, the transition is designed to be largely automatic. During the first unseal operation after upgrading to Vault Enterprise 2.0, the platform identifies legacy LDAP static roles and migrates them to the new rotation framework in the background. Vault continues normal operations throughout the process, while administrators can monitor migration progress through dedicated APIs and governance controls. The migration model reflects a broader emphasis on minimizing disruption while modernizing security controls. By automating credential lifecycle management and reducing manual intervention, organizations can focus more on governance and policy management rather than operational maintenance. Research into secrets management practices has highlighted the difficulties organizations face when managing credentials at scale, particularly when manual processes are involved. Automated rotation and centralized governance are widely viewed as important steps toward reducing credential exposure and limiting opportunities for attackers. The LDAP enhancements are part of a larger Vault Enterprise 2.0 release focused on identity-based security, credential lifecycle automation, and centralized secrets management. As organizations adopt hybrid cloud environments, AI-driven systems, and increasingly automated infrastructure, the number of non-human identities requiring management continues to grow rapidly. Craig Risi. Craig Risi is a man of many talents but has no sense of how to use them. He could be out changing the world but prefers to make software instead. He possesses a passion for software design, but more importantly software quality and designing systems in a technically diverse and constantly evolving tech world. Craig is also the writer of the book, Quality By Design: Designing Quality Software Systems, and writes regular articles on his blog sites and various other tech sites around the world. When not playing with software, he can often be found writing, designing board games, or running long distances for no apparent reason.