diff --git a/terraform/azure-pipelines.yml b/terraform/azure-pipelines.yml
index 3aa04213..4c5f7e98 100644
--- a/terraform/azure-pipelines.yml
+++ b/terraform/azure-pipelines.yml
@@ -9,11 +9,18 @@ stages:
       vmImage: ubuntu-latest
     jobs:
       - job: plan
-        # https://learn.microsoft.com/en-us/azure/devops/pipelines/process/expressions?view=azure-devops#conditional-insertion
-        variables:
-          reason: $[variables['Build.Reason']]
-          target: $[variables['System.PullRequest.TargetBranch']]
         steps:
+          - bash: |
+              echo $REASON
+              echo $SOURCE
+              echo $TARGET
+
+              WORKSPACE=$(python terraform/workspace.py)
+              echo "##vso[task.setvariable variable=one]$(WORKSPACE)"
+            env:
+              REASON: $(Build.Reason)
+              SOURCE: $(Build.SourceBranchName)
+              TARGET: $(System.PullRequest.TargetBranch)
           - task: Bash@3
             inputs:
               targetType: "inline"
diff --git a/terraform/workspace.py b/terraform/workspace.py
new file mode 100644
index 00000000..a36c0476
--- /dev/null
+++ b/terraform/workspace.py
@@ -0,0 +1,13 @@
+import os
+
+REASON = os.environ["REASON"]
+SOURCE = os.environ["SOURCE"]
+TARGET = os.environ["TARGET"]
+
+# on pull requests, base on target branch; otherwise base on the source branch
+if REASON == "PullRequest" and TARGET in ["test", "prod"]:
+    print(TARGET)
+elif SOURCE in ["test", "prod"]:
+    print(SOURCE)
+else:
+    print("dev")