diff --git a/cli/internal/cmd/upgradeapply.go b/cli/internal/cmd/upgradeapply.go
index c4753ad7f..6f426a36d 100644
--- a/cli/internal/cmd/upgradeapply.go
+++ b/cli/internal/cmd/upgradeapply.go
@@ -110,8 +110,11 @@ func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command, fileHandler file.Hand
 	if err := u.upgradeAttestConfigIfDiff(cmd, conf.GetAttestationConfig(), flags); err != nil {
 		return fmt.Errorf("upgrading measurements: %w", err)
 	}
-
-	migrateIAM := getIAMMigrateCmd(cmd, u.upgrader.GetTerraformUpgrader(), conf, flags, u.upgrader.GetUpgradeID())
+	tfClient, err := u.upgrader.GetTerraformUpgrader(cmd.Context(), constants.TerraformIAMUpgradeWorkingDir)
+	if err != nil {
+		return fmt.Errorf("getting terraform client: %w", err)
+	}
+	migrateIAM := getIAMMigrateCmd(cmd, tfClient, conf, flags, u.upgrader.GetUpgradeID())
 	if err := u.executeMigration(cmd, fileHandler, migrateIAM, flags); err != nil {
 		return fmt.Errorf("executing IAM migration: %w", err)
 	}
@@ -232,6 +235,7 @@ func getIAMMigrateCmd(cmd *cobra.Command, tfClient *terraform.Client, conf *conf
 }
 
 func (u *upgradeApplyCmd) executeMigration(cmd *cobra.Command, file file.Handler, migrateCmd terraform.MigrationCmd, flags upgradeApplyFlags) error {
+	u.log.Debugf("Executing %s", migrateCmd.String())
 	hasDiff, err := migrateCmd.Plan(cmd.Context()) // u.upgrader.PlanTerraformMigrations(cmd.Context(), opts)
 	if err != nil {
 		return fmt.Errorf("planning terraform migrations: %w", err)
@@ -253,7 +257,6 @@ func (u *upgradeApplyCmd) executeMigration(cmd *cobra.Command, file file.Handler
 			}
 		}
 		u.log.Debugf("Applying Terraform %s migrations", migrateCmd.String())
-		// .ApplyMigration()
 		err := migrateCmd.Apply(cmd.Context(), file) // u.upgrader.ApplyTerraformMigrations(cmd.Context(), file, opts)
 		if err != nil {
 			return fmt.Errorf("applying terraform migrations: %w", err)
@@ -506,7 +509,7 @@ type cloudUpgrader interface {
 	CheckTerraformMigrations(fileHandler file.Handler) error
 	CleanUpTerraformMigrations(fileHandler file.Handler) error
 	AddManualStateMigration(migration terraform.StateMigration)
-	GetTerraformUpgrader() *terraform.Client
+	GetTerraformUpgrader(ctx context.Context, terraformDir string) (*terraform.Client, error)
 	GetUpgradeID() string
 }
 
diff --git a/cli/internal/kubernetes/upgrade.go b/cli/internal/kubernetes/upgrade.go
index 527229fe6..6f58f8aab 100644
--- a/cli/internal/kubernetes/upgrade.go
+++ b/cli/internal/kubernetes/upgrade.go
@@ -153,8 +153,12 @@ func NewUpgrader(ctx context.Context, outWriter io.Writer, log debugLog, upgrade
 	return u, nil
 }
 
-func (u *Upgrader) GetTerraformUpgrader() *terraform.Client {
-	return u.tfClient
+func (u *Upgrader) GetTerraformUpgrader(ctx context.Context, terraformDir string) (*terraform.Client, error) {
+	tfClient, err := terraform.New(ctx, filepath.Join(constants.UpgradeDir, u.upgradeID, terraformDir))
+	if err != nil {
+		return nil, fmt.Errorf("setting up terraform client: %w", err)
+	}
+	return tfClient, nil
 }
 
 func (u *Upgrader) GetUpgradeID() string {
diff --git a/cli/internal/terraform/BUILD.bazel b/cli/internal/terraform/BUILD.bazel
index edf5e3ee8..be2b3958c 100644
--- a/cli/internal/terraform/BUILD.bazel
+++ b/cli/internal/terraform/BUILD.bazel
@@ -95,6 +95,7 @@ go_library(
 go_test(
     name = "terraform_test",
     srcs = [
+        "iammigrate_test.go",
         "loader_test.go",
         "terraform_test.go",
         "variables_test.go",
diff --git a/cli/internal/terraform/iammigrate.go b/cli/internal/terraform/iammigrate.go
index ced2efdc6..68724c065 100644
--- a/cli/internal/terraform/iammigrate.go
+++ b/cli/internal/terraform/iammigrate.go
@@ -54,11 +54,12 @@ func (c *IAMMigrateCmd) String() string {
 }
 
 func (c *IAMMigrateCmd) Plan(ctx context.Context) (bool, error) {
+	templateDir := filepath.Join("terraform", "iam", strings.ToLower(c.csp.String()))
 	err := c.tf.PrepareIAMUpgradeWorkspace(
-		filepath.Join("terraform", "iam", strings.ToLower(c.csp.String())),
+		templateDir,
 		constants.TerraformIAMWorkingDir,
 		filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformIAMUpgradeWorkingDir),
-		filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformUpgradeBackupDir), // TODO: use IAM backup dir
+		filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformIAMUpgradeBackupDir), // TODO: use IAM backup dir
 	)
 	if err != nil {
 		return false, fmt.Errorf("preparing terraform workspace: %w", err)
@@ -66,7 +67,7 @@ func (c *IAMMigrateCmd) Plan(ctx context.Context) (bool, error) {
 
 	hasDiff, err := c.tf.Plan(ctx, c.logLevel, constants.TerraformUpgradePlanFile)
 	if err != nil {
-		return false, fmt.Errorf("terraform plan: %w", err)
+		return false, fmt.Errorf("terraform plan 1: %w", err)
 	}
 
 	if hasDiff {
diff --git a/cli/internal/terraform/iammigrate_test.go b/cli/internal/terraform/iammigrate_test.go
index 76b1ca76d..5d67072a7 100644
--- a/cli/internal/terraform/iammigrate_test.go
+++ b/cli/internal/terraform/iammigrate_test.go
@@ -70,6 +70,10 @@ func TestIAMMigrate(t *testing.T) {
 	res, err = fs.Stat(filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformIAMUpgradeWorkingDir))
 	assert.Error(t, err)
 	assert.Nil(t, res)
+
+	res, err = fs.Stat(filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformUpgradeBackupDir))
+	assert.Error(t, err)
+	assert.Nil(t, res)
 }
 
 type tfClientStub struct {
diff --git a/cli/internal/upgrade/main/BUILD.bazel b/cli/internal/upgrade/main/BUILD.bazel
index c06a85b16..27680826a 100644
--- a/cli/internal/upgrade/main/BUILD.bazel
+++ b/cli/internal/upgrade/main/BUILD.bazel
@@ -8,7 +8,6 @@ go_library(
     deps = [
         "//cli/internal/terraform",
         "//cli/internal/upgrade",
-        "//internal/cloud/cloudprovider",
         "//internal/constants",
     ],
 )
diff --git a/internal/constants/constants.go b/internal/constants/constants.go
index 3040eb802..8004bcf3d 100644
--- a/internal/constants/constants.go
+++ b/internal/constants/constants.go
@@ -158,6 +158,8 @@ const (
 	TerraformIAMUpgradeWorkingDir = "terraform-iam"
 	// TerraformUpgradeBackupDir is the directory name being used to backup the pre-upgrade state in an upgrade.
 	TerraformUpgradeBackupDir = "terraform-backup"
+	// TerraformIAMUpgradeBackupDir is the directory name being used to backup the pre-upgrade state of iam in an upgrade.
+	TerraformIAMUpgradeBackupDir = "terraform-iam-backup"
 	// TerraformMigrationOutputFile is the file name of the output file created by a successful Terraform migration.
 	TerraformMigrationOutputFile = "terraform-migration-output.json"
 	// UpgradeDir is the name of the directory being used for cluster upgrades.