Any update here?
It’s been almost 2y and seems Hashicorp still did not address it.
The way to ensure predictable source IP addresses is to run your own agents on IP addresses of your own. That will then ensure that you can restrict to exactly the IP addresses your agents are using, rather than permitting access to your system from any Terraform Cloud workspace run by any organization.
Keeping in mind that anyone can run any Terraform configuration they wish on the hosted cloud agents, which can therefore make arbitrary network requests to any destination, restricting to only accept connections from those would be little better than allowing connections from anywhere on the internet.
The hosted agents for Terraform Cloud are suitable for working with systems that rely on credentials rather than network addresses for access control, but if you need to filter by source network address (either exclusively or in combination with credentials) then hosting your own agents is the appropriate solution.
makes sense from a security point of view; thank you.