CLI Deployments

The Tharsis CLI provides flags for deploying Terraform modules directly from the command line. You can deploy from a local directory or a remote module source.

tip

You can also manage deployments via AI assistants using the CLI's built-in MCP server.

Local modules

Upload and apply a local Terraform configuration directory:

Apply a local module

tharsis apply -directory-path /path/to/terraform/config my-group/my-workspace

Remote modules

Deploy a module from a registry without writing Terraform configuration locally. This works with the plan, apply, and destroy commands.

Plan a remote module

tharsis plan \
  -module-source https://registry.example.com/org/network/aws \
  -module-version "2.3.0" \
  my-group/my-workspace

Apply a remote module

tharsis apply \
  -module-source https://registry.example.com/org/network/aws \
  -module-version "2.3.0" \
  -auto-approve \
  my-group/my-workspace

Destroy resources from a remote module

tharsis destroy \
  -module-source https://registry.example.com/org/network/aws \
  -module-version "2.3.0" \
  -auto-approve \
  my-group/my-workspace

For private registries, pass the credential token as an environment variable:

Apply from a private registry

tharsis apply \
  -env-var "TF_TOKEN_registry_example_com=<access_token>" \
  -module-source https://registry.example.com/org/network/aws \
  -module-version "2.3.0" \
  my-group/my-workspace

See Module Sources for details on registry authentication.

Flags

Flag	Description	Required
-directory-path	Path to a local Terraform configuration directory. Conflicts with -module-source.	No
-module-source	URI to a remote module. Conflicts with -directory-path.	No
-module-version	Module version. Defaults to latest.	No
-env-var	Environment variable as a key=value pair. Can be specified multiple times.	No
-env-var-file	Path to a file containing environment variables.	No
-tf-var	Terraform variable as a key=value pair. Can be specified multiple times.	No
-tf-var-file	Path to a .tfvars file. Supports HCL variables.	No
-auto-approve	Skip the confirmation prompt and automatically apply after planning.	No

don't forget the managed identity!

If deploying to AWS or Azure, be sure to assign a managed identity to the target workspace!