Organization
Your team’s account. Members, roles, single sign-on, SCIM provisioning, API tokens, and the audit log belong to an organization. You can belong to several organizations and switch between them from the top of the sidebar.
Project
A named group of related workspaces, such as Platform or Payments. Project
names and slugs are unique within an organization.
Workspace
One OpenTofu configuration with its own state, variables, credentials, policy, and run history. Each workspace has:
- an exact OpenTofu version (
1.6.0or newer); - an execution region, such as North America East (the default) or Europe West, where its runs always execute;
- an optional GitHub source (repository, branch, and working directory); and
- one state history.
Runs in a workspace happen one at a time, so two applies never race. A run
started while another run is active in the workspace is refused, not queued;
start it again once the active run finishes. Scheduled
drift checks never count as the active run and never
cause a run to be refused. A
StackShip workspace is not the same as an OpenTofu CLI workspace
(tofu workspace).
Run
One plan, its policy checks, an optional approval, and an optional apply. There are three kinds:
| Kind | What it does | Started by |
|---|---|---|
| Plan and apply | Plans, checks policy, waits for approval, then applies | Push to the tracked branch, tofu apply, or the API |
| Plan only | Plans and checks policy; never applies | tofu plan or the API |
| Speculative | A preview plan for a pull request; never applies and gets no sensitive variables | Pull request to the tracked branch |
Each run records the commit, variables, credentials, and OpenTofu version it used, so retries and reviews refer to the same inputs. See run lifecycle.
State version
A saved copy of the workspace’s state. Every successful write creates a new version with its serial number, resource count, size, and checksum. Older versions are kept, and authorized users can download any version. See state.
Variables
OpenTofu input variables and environment variables set on a workspace. Mark a value sensitive to make it write-only. See variables and secrets.
Credential profile
How a workspace authenticates to your cloud. AWS, Google Cloud, and Microsoft Azure profiles use short-lived federation, so no long-lived cloud key is stored. Use generic environment secrets when federation isn’t possible. Each change creates a new version that you verify before runs use it.
Policy set
A set of Rego rules evaluated against every plan. Publishing a change creates a new version, and you attach a specific version to a workspace. See policy sets.
GitHub source
The repository, tracked branch, working directory, and optional trigger paths a workspace builds from. Every run is pinned to an exact commit. See GitHub source connections.