A Guide to Terraform Audit Logs

Terraform itself doesn't keep an audit log. It applies changes, but nothing records who logged in, who changed a variable, or who approved a run, so that record has to come from the platform running Terraform. A usable one is append-only, captures logins (including failed ones), permission changes, variable and state access, and run approvals with user, timestamp, and source IP, and exports to CSV or JSON when an auditor asks for four months of it. Here's what to capture, which HCP Terraform and Scalr tiers include it, and how to stream it to Datadog or EventBridge.

Why Your Organization Needs Terraform Audit Logs

A complete audit trail answers who, what, and when for every change. Without a reliable system for Terraform audit logs, you're exposed to security, compliance, and operational risks.

Security and Incident Response

In the event of a security incident, Terraform audit logs are your primary source of truth. They provide a detailed timeline of events, enabling security teams to trace the origin of a breach, understand the scope of unauthorized changes, and identify the responsible party. For example, if a sensitive variable is accessed or a security group is modified, the audit log will show precisely which user or service account initiated the action, from what IP address, and at what time.

The distinction that matters here is append-only history versus current state. In May 2026, the security team at one enterprise we work with at Scalr was threat-hunting for supply-chain attacks delivered through malicious Terraform modules. They started with provider and module usage reports, then discovered those reports only reflect each workspace's most recent run: a module that appeared in the report at 8:50 AM was gone nine minutes later, after the workspace ran again with an updated configuration. Their conclusion, verbatim: "If there were an incident… we don't have a source of truth for us to search." A current-state report tells you what your infrastructure uses now; only an append-only audit log can tell you what it used at the moment of compromise.

Meeting Compliance Requirements

Many regulatory frameworks like SOC 2, HIPAA, and PCI DSS have strict requirements for logging and auditing. To pass an audit, you must be able to prove that all changes to your infrastructure are tracked and authorized. Terraform audit logs serve as the definitive evidence to satisfy auditors and demonstrate that you have control over your production environment.

What auditors actually ask for is more specific than the frameworks suggest. In May 2026, a customer preparing for a security review needed four months of records, January 1 through April 22, covering login and access events (both successful and failed authentication) plus every administrative action: configuration changes, permission modifications, and account and user management. The auditor wanted it in CSV or JSON, in the "most detailed format available." That request shape comes up constantly in Scalr's support queue.

It has a corollary: the question about retention limits tends to arrive late. One customer, already mid-audit, asked Scalr support for twelve months of logs and only then asked what the retention window was. Confirm your retention horizon before the auditor does.

What to Capture in Terraform Audit Logs

A useful audit logging system for Terraform has to capture more than just run events. For complete visibility, your Terraform audit logs should cover a lot of activity across the platform. The key events to capture:

• User and Authentication Events: Logins, logouts, and failed authentication attempts.
• Administrative Changes: Modifications to workspaces, environments, user permissions, and VCS provider settings.
• Variable and State Access: Creation, updates, and deletions of variables (especially those marked as sensitive).
• Run Lifecycle Events: Run creations, approvals, denials, and cancellations.
• Object Creation/Deletion: Events for when workspaces, environments, or other resources are created or deleted.

Each log entry must contain sufficient context, including a timestamp, the user who performed the action, their source IP address, and a detailed message describing the event.

Which Terraform Cloud tier includes audit logs?

On HCP Terraform (formerly Terraform Cloud), audit trails are in the Standard and Premium editions. Essentials doesn't include them, and HashiCorp's documentation notes the Audit Trails API isn't available for self-managed Terraform Enterprise. On Scalr, audit logs, streaming, and export are on the Enterprise plan; check pricing and the pricing FAQ for current gating. On both platforms, as of June 2026, a persistent audit log is a higher-tier capability, and you can't backfill events that were never recorded. So budget for the tier that turns it on, and check the retention window that comes with it, before the auditor asks.

Centralizing Terraform Audit Logs

Audit logs only help where your security team already looks. Ship them into Datadog or EventBridge next to your application and cloud logs, and a Terraform run shows up beside the alert it caused. You also reuse the dashboards and alert rules you've already built instead of maintaining a second set. Scalr captures every event on the platform, from logins to variable changes to run approvals, and streams both the audit log and run events to each.

One caveat from production experience: streaming is delivery, not retention. When a major cloud outage took down one customer's log pipeline in October 2025, their streaming destination stopped receiving events for roughly two days, October 19 through 21, and they came to Scalr needing that window backfilled. If your compliance posture depends on an unbroken log, treat the streaming integration as one leg and keep an export or backfill path as the other. The same lesson applies after deletions: one team came to Scalr after deleting a workspace, needing the run history that went with it. Logs you have already exported survive the resources they describe.

Sending Audit Logs and Events to Datadog

Scalr can send audit logs directly to Datadog Logs. This allows you to unify your Terraform audit logs with application, security, and other infrastructure logs already being collected in Datadog. Once in Datadog, you can use its powerful search, analytics, and visualization features to create dashboards that track key Terraform activities, monitor for specific security events, and set up alerts on suspicious behavior.

Scalr also sends events to Datadog, such as when a run errored, how the run was executed, and when. While these details are similar to audit logging, they can also be used for monitoring and alerting in event-driven workflows, as seen below.

See the official docs on how to set up the integration with Datadog here.

Sending Audit Logs and Events to AWS EventBridge

Scalr sends the same audit log details and run events to an Amazon EventBridge event bus, as two event types: RunExecuted for the run lifecycle and AuditLog for audit events, plus an AuditLogDisabled alert if streaming stops. From there you can forward them to any tool EventBridge integrates with, land them in CloudWatch, or use them as triggers, which is what the next section is about.

See the official docs for the Scalr integration with AWS Eventbridge here.

Using Terraform Audit Logs for Event-Driven Workflows

When Scalr sends an event to your EventBridge event bus, you can create rules that filter for specific events and route them to targets. This enables powerful automation, such as:

• Triggering an AWS Lambda function when a RunExecuted event arrives with a completed detail.status for a production environment. The function could create a change ticket in Jira, post a custom summary to a Slack channel, or run a post-deployment validation script.
• Starting an AWS Step Functions workflow when an AuditLog event is detected with a workspace-creation detail.event. This could orchestrate a series of compliance checks, apply a standard set of policies, and notify a platform administrator that a new workspace is ready for review.
• Sending a notification via Amazon SNS when a RunExecuted event arrives with an error detail.status. This can be used for customized email, SMS, or PagerDuty alerts that go beyond standard notifications.

When you route the events from your Terraform audit logs into AWS EventBridge, the same data that proves what happened can also trigger what happens next, so a workspace creation or a failed run kicks off the right ticket, alert, or check automatically.