Loading page
About this tool
Decide between CLI workspaces, directory-per-environment or fully separate state for Terraform, with scored trade-offs.
This planner scores the three standard ways of separating Terraform environments — CLI workspaces, a directory per environment, and fully separate state backends — against your answers about divergence, isolation, team shape and account layout. The heuristics follow HashiCorp's published guidance that workspaces suit multiple states of the same configuration behind one backend, while strong isolation calls for separate backends. It is for DevOps engineers deciding a repo layout before the codebase grows around the wrong one.
Open Terraform Workspace Strategy Planner on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
Each strategy gets a 0-10 score with every plus and minus itemised, so you can challenge the reasoning.
Encodes the documented rule that workspaces share one backend and one credential set.
Each strategy ships with a copyable directory tree and the commands that drive it.
Only when both environments run the same configuration with different variable values and share one backend and credential set. HashiCorp's own documentation notes workspaces are not suited to strong isolation; once prod lives in a separate account or needs separate credentials, use separate directories or separate backends instead.
Workspaces keep one root module and switch state files with terraform workspace select, while directories give each environment its own root module and its own state. Workspaces minimise duplication; directories allow environments to diverge and to point at different backends or accounts.
Give each environment its own backend — for example a separate S3 bucket and DynamoDB lock table per account — wired via partial backend configuration, Terragrunt remote_state blocks, or one HCP Terraform workspace per environment. This is the strongest isolation because a bad apply or leaked credential in dev cannot reach prod state.
It is a warning sign. A few lookups keyed on terraform.workspace are fine, but once resources are created conditionally per workspace the configurations have effectively diverged, and most teams are better served splitting into per-environment root modules before the conditional logic compounds.