---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "orcasecurity_integration_terraform_cloud Resource - orcasecurity"
subcategory: ""
description: |-
  Manage a Terraform Cloud / HCP Terraform integration in Orca.
---

# orcasecurity_integration_terraform_cloud (Resource)

Manages a [Terraform Cloud / HCP Terraform](https://app.terraform.io/) (or
Terraform Enterprise) integration in Orca Security.

Under the hood this creates an entry under `POST /api/external_service/config`
with `service_name = "terraform_cloud"`. The API token is stored in Orca's
secret store and is never returned by the API.

## Example Usage

### Basic example

```terraform
# Terraform Cloud integration
resource "orcasecurity_integration_terraform_cloud" "example" {
  template_name = "display_name"
  api_url       = "https://app.terraform.io"
  api_token     = var.terraform_cloud_api_token
  is_enabled    = true
  is_default    = false
}
```

### Sourcing the token from HashiCorp Vault

```terraform
data "vault_generic_secret" "tfc" {
  path = "secret/terraform-cloud/orca"
}

resource "orcasecurity_integration_terraform_cloud" "from_vault" {
  template_name = "tfc-prod"
  api_url       = "https://app.terraform.io"
  api_token     = data.vault_generic_secret.tfc.data["api_token"]
}
```

## Argument Reference

* `template_name` — (Required, String) Identifier for the integration as shown
  in the Orca UI. Changing this forces a new resource.
* `api_url` — (Required, String) Terraform Cloud API URL. Use
  `https://app.terraform.io` for HCP Terraform or your Terraform Enterprise
  hostname.
* `api_token` — (Required, String, Sensitive) Terraform Cloud service-account
  API token.
* `is_enabled` — (Optional, Bool) Defaults to `true`.
* `is_default` — (Optional, Bool) Defaults to `false`.

## Attribute Reference

* `id` — (String) Orca external service config identifier (UUID).

## Notes

* Orca strips `api_token` from `GET` responses (stored in SSM). The provider
  keeps the value already in Terraform state to avoid permanent diffs. Rotate
  through `terraform apply`; for out-of-band rotation use
  `terraform apply -replace=orcasecurity_integration_terraform_cloud.example`.
* Use an encrypted remote backend (S3 + KMS, GCS, Terraform Cloud, etc.) and
  restrict read access to the state.

## Import

```bash
terraform import orcasecurity_integration_terraform_cloud.example display_name
```

After import, set the `api_token` argument in your configuration — the API
does not return it.