Topic starter
03/06/2026 2:23 pm
TL;DR: Saviynt says its Terraform Provider has reached HashiCorp Partner Premier status, which it frames as recognition that IGA must govern Day 2 conditions such as credential shadowing, infrastructure-to-governance bridging, and continuous identity posture sync as environments change. The real shift is that governance has to control infrastructure-driven access states after provisioning, not just approve them at creation time.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Saviynt Earns HashiCorp Partner Premier Status — The Only IGA Provider in the Program”.
Key questions
Q: How should security teams govern Terraform-managed access after initial provisioning?
A: They should treat Terraform-managed access as a lifecycle control problem, not a one-time approval event.
Q: Why does credential shadowing create risk in infrastructure-as-code environments?
A: Credential shadowing creates risk because privileged access can persist outside the governance record even when the infrastructure itself is functioning correctly.
Q: What breaks when identity posture is not synced to infrastructure changes?
A: Access reviews, policy enforcement, and audit evidence all become stale at the same time.
Practitioner guidance
- Map Terraform state changes to identity events Treat resource creation, replacement, and teardown as governance-relevant signals so access posture can be reconciled whenever infrastructure changes.
- Inventory privileged connector credentials Build a complete register of connector accounts, tokens, and embedded secrets used by infrastructure automation, then tie each one to an owner and lifecycle state.
- Align certification cadence to infrastructure churn Shorten or retime access reviews for infrastructure-managed access so governance can catch drift before the next major environment change.
Bottom line: Terraform governance is no longer only about provisioning because access states continue to change after initial deployment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 2:31 pm
Day 2 control is now the real IGA boundary. Terraform changed the centre of gravity from request-and-approve workflows to continuous state management. Once access is expressed as infrastructure, governance has to understand drift, rebuilds, and connector lifecycle changes as identity events. The implication is that IGA programmes that stop at provisioning are no longer governing the full access lifecycle.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should IAM and DevOps teams separate provisioning controls from governance controls?
A: They should separate the functions, but not the evidence chain. Provisioning can create access, while governance must continuously verify that the resulting access still matches policy, ownership, and approval intent as infrastructure evolves.
👉 Read our full editorial: Terraform governance for IGA now extends into Day 2 control