Terraform | Cloud Agent

How to set up a Terraform Cloud Agent on a private Azure infrastructure.

May 07, 2025

With a private Azure infrastructure, locked behind a firewall, I had no way of setting up Key Vaults and Storage Accounts. The Control and Data Planes that manage this access are subsequently locked down as private.

I needed to set up a Terraform Cloud Agent on my internal network to allow HCP access to perform runs and set up resources.

Click on Create Agent Pool in HCP.
Give it a name.
Give the token a meaningful description and click Create Token.
Copy the token information and store it in a secure password or key vault.
Set up a virtual network to host your internal Container (where the Cloud Agent will be installed). Amend the firewall to allow anything on the virtual network container subnet out.
I chose to host my agent on a container instance on an internal virtual network.
Configured as follows:
Once set up, check the status of the container.
Then check the status in HCP. It should be populated with an external IP address.
Go to the Workspace in HCP and change it to use the Agent Pool. Give the Workspace a run to make sure it will pick up and use the Agent.