How-to Reset Terraform Enterprise Administrator Password via Rails

Introduction

This guide provides the procedure for resetting the administrator password for a Terraform Enterprise instance via the Rails console.

Expected Outcome

You will regain access to the administrator account in Terraform Enterprise.

Prerequisites

• Administrative shell access (SSH) to the Terraform Enterprise instance.

Use Case

This procedure is for situations where you cannot log in as the administrator and promoting another account to site admin is not an option.

Procedure

1. Establish an SSH connection to your Terraform Enterprise instance.

2. Launch the Rails console. The command varies based on your Terraform Enterprise version and runtime environment.

   For versions v202309-1 and later

   Select the command that matches your deployment environment.

   Docker:

   $ sudo docker exec -it terraform-enterprise tfectl support console

   Podman:

   $ sudo podman exec -it terraform-enterprise-terraform-enterprise tfectl support console

   Kubernetes:

   $ sudo kubectl exec -it -n <tfe_namespace> <tfe_pod_name> -- tfectl support console

   Note: Replace <tfe_namespace> and <tfe_pod_name> with the appropriate values for your environment.

   For versions v202205-1 through v202308-1

   Execute the following command:

   $ sudo docker exec -it tfe-atlas /usr/bin/init.sh /app/scripts/wait-for-token -- bash -i -c 'cd /app && ./bin/rails c'

   For versions prior to v202205-1

   Execute the following command:

   $ sudo docker exec -it ptfe_atlas /usr/bin/init.sh /app/scripts/wait-for-token -- bash -i -c 'cd /app && ./bin/rails c'

3. Once in the Rails console, find the administrator account and assign it to a variable.

   user = User.find_by(username: 'administrator')

4. Set a new password for the user.

   user.password = 'your-new-secure-password'

   Note: The password must be at least 10 characters long.

5. Save the changes and exit the Rails console.

   user.save!
   exit

6. Log in to the Terraform Enterprise UI with the new password. If two-factor authentication is enabled for the administrator account, you will be prompted for a code.

Additional Information

• For alternative methods, refer to the guide on Restoring Site Admin Access When No Accounts Have Access.