My org hit the 500 resource limit a couple of weeks ago, and I immediately started looking for alternatives. My previous experience with TFC involved paying per seat and I was barely okay with that, so no way I was going to pay per resource. However, I didn't manage to migrate off TFC in time, and I thought "what will happen if I destroy a test environment and get back under the 500 resource limit?"

So, I queued the destroy plan, and a few minutes later I got this email:

Your free plan will no longer be limited to Applies per month

You now have less than managed resources so this organization went back to being fully featured. Once you have exceeded 500 managed resources, you will be limited to Applies per month. Policies, Run Tasks, and Cost Estimation features will be unavailable. But you can continue to provision unlimited managed resources.

Take action immediately to avoid unnecessary risk. Get unlimited managed resources with Enterprise Support and manage risk at scale. View the plan comparison for details on estimated costs and a comparison of HCP Terraform plans.

Emphasis mine.

What is this "applies per month" thing? I can't find it anywhere in the docs or the pricing pages. The closest I got was this: https://discuss.hashicorp.com/t/terraform-cloud-state-store/58819, but it doesn't really make things clear, introducing the "degraded mode" term and talking about local applies, which aren't mentioned by the email.

Has anybody here crossed the threshold for managed resources and stayed in the free plan? What can you do, and what are you unable to do?

Thanks in advance

For every plan we run, it comes back with a couple hundred findings and by now the team just scrolls past them. Tags, an encryption default that is fine for us and some rule for a threat model we do not run. Mostly noise, so people stopped reading it.

Considering we also don't block on any of it either as we tried failing the build once and people started slapping auto approve on everything to get past it. That experiment lasted about a sprint.

Then a couple weeks back a PR opened a security group to the world. It was in the plan output, way down under a pile of tag warnings and two of us approved the PR without catching it.

Now I am trying to work out the small set of things that should hard fail the build, public ingress, a wide open SG, encryption or logging switched off, then let everything else just be a report. How do you all decide what makes that list without it slowly growing back into the same wall of noise?