Summary

On April 19, 2026, Terraform-based IaCM pipelines failed across production environments due to an issue with Terraform binary verification during runtime.

The issue was caused by an expired OpenPGP signing key in a third-party library used to validate Terraform downloads. This resulted in failures when pipelines attempted to install Terraform dynamically.

Impact

• Terraform-based IaCM pipelines failed during execution
• Failures occurred at runtime when attempting to download/verify Terraform binaries

• Customers Unaffected:

  • OpenTofu-based pipelines
  • Pipelines using pre-installed or cached Terraform binaries

Customers pinning plugin versions older than the fixed release continued to experience failures until upgraded.

Root Cause

The IaCM Terraform plugin relies on a third-party library (HashiCorp’s hc-install) to download and verify Terraform binaries.

• The library contained a hardcoded OpenPGP signing key
• This key expired, causing verification failures during Terraform installation
• HashiCorp had not yet released an updated version with a renewed key

Remediation

Immediate Mitigation

• Released IaCM Terraform plugin v0.214.0

• Modified behavior to:

  • Bypass the expired signature verification step
  • Continue secure downloads over HTTPS

Resolution

• Rolled out the fix across prod0–prod4
• Pipeline execution functionality was restored

Customer Actions Required

• Customers using pinned plugin versions older than v0.214.0 must:

  • Upgrade to v0.214.0 or later

• No action required for customers using default/latest plugin versions

Prevention & Next Steps

We are implementing the following improvements:

• Dependency Monitoring

  • Proactive monitoring for third-party certificate/key expirations

• Upstream Coordination

  • Track HashiCorp release for updated signing key
  • Re-enable signature verification once available

• Customer Communication

  • Notify customers using older pinned versions

• Operational Improvements

  • Enhance validation of external dependencies in runtime workflows