ServiceNow Terraform Integration Guide

Architecture Overview

Implementation Steps

var gr = new GlideRecord('u_terraform_workspace_mapping');
gr.initialize();
gr.u_change_category = 'Infrastructure';
gr.u_configuration_item = current.cmdb_ci.sys_id;
gr.u_workspace_id = 'ws-abc123def456';
gr.u_organization = 'my-terraform-org';
gr.u_auto_approve = false;
gr.insert();

var planData = action.getResult('terraform_plan_output');
var workNotes = 'Terraform Plan Summary:\n';
if (planData.resource_changes) {
    workNotes += 'Resources to add: ' + planData.resource_changes.filter(r => r.change.actions.includes('create')).length + '\n';
    workNotes += 'Resources to modify: ' + planData.resource_changes.filter(r => r.change.actions.includes('update')).length + '\n';
    workNotes += 'Resources to delete: ' + planData.resource_changes.filter(r => r.change.actions.includes('delete')).length;
}
current.work_notes = workNotes;
current.update();

var runDetails = action.getResult('terraform_run_details');
if (runDetails.data.attributes.status == 'applied') {
    current.state = 3; // Implemented
    current.work_notes = 'Terraform apply completed successfully. Resources provisioned: ' + runDetails.data.attributes['resource-additions'];
} else if (runDetails.data.attributes.status == 'errored') {
    current.state = -4; // Review
    current.work_notes = 'Terraform apply failed: ' + runDetails.data.attributes['status-message'];
}
current.update();

var terraformRuns = new GlideRecord('u_terraform_runs');
terraformRuns.addQuery('state', 'pending');
terraformRuns.addQuery('sys_created_on', '>', gs.hoursAgoStart(1));
terraformRuns.query();
while (terraformRuns.next()) {
    var rm = new RESTMessageV2();
    rm.setEndpoint('https://app.terraform.io/api/v2/runs/' + terraformRuns.run_id);
    rm.setHttpMethod('GET');
    rm.setRequestHeader('Authorization', 'Bearer ' + getCredentialValue('terraform_api_token'));
    var response = rm.execute();
    var runData = JSON.parse(response.getBody());
    terraformRuns.state = runData.data.attributes.status;
    terraformRuns.update();
}

Common Use Cases

Troubleshooting

Pro Tips

• →Configure Terraform workspace naming conventions that include ServiceNow change request numbers to create automatic traceability between infrastructure changes and change records, enabling powerful audit reporting and compliance tracking. Use Terraform Cloud's workspace tags to categorize environments and automatically apply different approval workflows based on production versus non-production infrastructure changes.
• →Implement custom Business Rules on the Change Request table to automatically populate Terraform variable values from CMDB attributes, enabling dynamic infrastructure provisioning based on configuration item relationships and dependencies. This approach ensures consistency between ServiceNow's configuration management database and actual infrastructure deployments while reducing manual data entry errors.
• →Leverage ServiceNow's Notification scheme to create Slack or Teams notifications when Terraform plans show high-risk changes like resource deletions or security group modifications, providing real-time awareness beyond standard change approval workflows. Include plan cost estimates in these notifications by integrating with cloud provider pricing APIs to enable better financial decision-making during the approval process.
• →Set up Performance Analytics datasets that correlate Terraform execution times with change request complexity metrics to identify optimization opportunities and predict infrastructure provisioning timelines. Use this data to automatically adjust change request implementation schedules and provide accurate delivery estimates to business stakeholders requesting infrastructure changes.
• →Create a dedicated ServiceNow Application Scope for your Terraform integration components to ensure proper version control and deployment practices when moving customizations between instances. This approach also enables easier maintenance of custom tables, workflows, and business rules while preserving integration functionality during ServiceNow upgrades.
• →Implement Terraform state file monitoring by creating scheduled jobs that compare ServiceNow CMDB records with actual Terraform state files to identify configuration drift and automatically generate change requests for remediation. This proactive approach ensures that infrastructure modifications made outside of ServiceNow workflows are captured and properly documented in your change management system.

Known Limitations

• —The Terraform Cloud API has rate limits of 30 requests per second per organization, which can impact high-volume change request processing and may require implementing request queuing or throttling mechanisms in your Flow Designer workflows. Large organizations with multiple concurrent infrastructure changes may need to implement request batching or staggered execution patterns to avoid API throttling errors.
• —Terraform plan outputs for complex infrastructure can exceed ServiceNow's field size limits (4000 characters for string fields, 65535 for text fields), requiring custom handling through attachments or external storage solutions when dealing with large-scale infrastructure deployments. This limitation particularly affects organizations with extensive AWS or Azure resource deployments that generate verbose plan outputs.
• —The Integration Hub Terraform Cloud spoke does not support Terraform Enterprise versions prior to v202006-1, limiting organizations using older on-premises Terraform installations from leveraging the pre-built integration capabilities. These environments require custom REST message implementations or upgrades to supported Terraform Enterprise versions to achieve full integration functionality.
• —ServiceNow's Flow Designer has a maximum execution time of 10 minutes per flow, which can be insufficient for complex Terraform apply operations that provision large infrastructure deployments or perform extensive resource modifications. Long-running Terraform operations require asynchronous monitoring patterns with scheduled jobs or webhook implementations to track completion status.
• —The spoke's authentication mechanism only supports Terraform Cloud API tokens and does not include support for more advanced authentication patterns like SAML or OIDC, which may be required for enterprise security compliance in organizations with strict identity management requirements. Custom authentication implementations may be necessary for environments requiring advanced identity integration patterns.

Frequently Asked Questions