> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-cli/harness-cli/harness-cli-commands/iacm-commands.md).

# Infrastructure as Code Management

Infrastructure as Code Management (IaCM) in Harness provisions and manages cloud infrastructure through Terraform and OpenTofu. IaCM also tracks Ansible inventories and playbooks, and provides a private Terraform module and provider registry. The CLI lets you list workspaces, inspect their current status, run remote plans, and browse your Ansible and registry inventory without opening the Harness UI.

This page covers all Infrastructure as Code Management resources and actions available in the CLI.

***

### What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this page, you will know how to:

* List and filter workspaces across your project.
* Inspect workspace configuration, state, and execution history.
* Run a remote Terraform or OpenTofu plan from the command line.
* Browse Ansible hosts, inventories, and playbooks.
* Browse the Terraform modules and providers published to the IaCM registry.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* **Harness CLI installed and authenticated:** For setup steps, see [Install and upgrade](/harness-platform/use-harness-cli/harness-cli/install-and-upgrade.md) and [Authenticate](/harness-platform/use-harness-cli/harness-cli/authenticate.md).
* **Project scope configured:** IaCM resources are project-scoped and require `--org` and `--project`. Set them in your profile or pass them on each command.
* **Workspace exists:** Operations run against existing workspaces. Create workspaces through the Harness UI or API before you run CLI operations.

{% hint style="info" %}
Workspace `create`, `update`, and `delete` commands are planned for Harness CLI v3.1. Until then, provision workspaces through the Harness UI or the REST API. Once a workspace exists, you can drive it fully from the CLI.
{% endhint %}

***

### Workspaces <a href="#workspaces" id="workspaces"></a>

A workspace represents a single Terraform or OpenTofu root module along with its state, variables, and connected source repository. Workspaces track the lifecycle of your infrastructure from initial creation through updates and eventual destruction. Each workspace belongs to a project and maintains its own execution history.

#### List workspaces <a href="#list-workspaces" id="list-workspaces"></a>

View all workspaces in your current project to see what infrastructure is managed and the current state of each workspace.

```sh
harness list workspace
harness list workspace --all --format json
harness list workspace --search "<search_term>"
harness list workspace --columns "name,id,status,lastRun"
```

#### Get workspace details <a href="#get-workspace-details" id="get-workspace-details"></a>

Retrieve the full configuration for a workspace, including its connected repository, variable sets, provider versions, and last execution status.

```sh
harness get workspace <workspace_id>
harness get workspace <workspace_id> --format json
```

***

### Run a remote plan <a href="#run-a-remote-plan" id="run-a-remote-plan"></a>

Execute a remote Terraform or OpenTofu plan on a workspace. The CLI streams execution output in real time and exits with the operation status code (0 for success, 1 for failure). Use a plan to validate your configuration and review proposed infrastructure changes before you commit them.

```sh
harness execute workspace <workspace_id>
```

If a `.harness/workspace.yaml` file is present in the current directory, the CLI reads the workspace from that file and you can omit the identifier:

```sh
harness execute workspace
```

Narrow or force the plan with these flags:

* **`--target`:** Restricts the plan to specific resource addresses.
* **`--replace`:** Forces replacement of the given resource addresses.
* **`--force`:** Runs the plan without the interactive confirmation prompt.

```sh
harness execute workspace <workspace_id> --target <resource_address>
harness execute workspace <workspace_id> --replace <resource_address>
harness execute workspace <workspace_id> --force
```

***

### Ansible hosts, inventories, and playbooks <a href="#ansible-hosts-inventories-and-playbooks" id="ansible-hosts-inventories-and-playbooks"></a>

IaCM tracks the Ansible hosts, inventories, and playbooks in your project. These resources are read-only in the CLI.

#### List and get hosts <a href="#list-and-get-hosts" id="list-and-get-hosts"></a>

Filter hosts by name, by the inventory they belong to, or by their current status.

```sh
harness list host
harness list host --search "<search_term>"
harness list host --inventory <inventory_id>
harness list host --status <status>
harness get host <host_id>
```

#### List and get inventories <a href="#list-and-get-inventories" id="list-and-get-inventories"></a>

```sh
harness list inventory
harness list inventory --all --format json
harness get inventory <inventory_id>
```

#### List and get playbooks <a href="#list-and-get-playbooks" id="list-and-get-playbooks"></a>

```sh
harness list playbook
harness list playbook --all --format json
harness get playbook <playbook_id>
```

***

### Module and provider registries <a href="#module-and-provider-registries" id="module-and-provider-registries"></a>

IaCM provides a private registry for the Terraform and OpenTofu modules and the Terraform providers that your teams consume. Both resources are read-only in the CLI.

#### List and get registry modules <a href="#list-and-get-registry-modules" id="list-and-get-registry-modules"></a>

```sh
harness list registry_module
harness list registry_module --all --format json
harness get registry_module <module_id>
```

#### List and get providers <a href="#list-and-get-providers" id="list-and-get-providers"></a>

```sh
harness list provider
harness list provider --all --format json
harness get provider <provider_id>
```

***

### Common workflows <a href="#common-workflows" id="common-workflows"></a>

#### List all workspaces in JSON for scripting <a href="#list-all-workspaces-in-json-for-scripting" id="list-all-workspaces-in-json-for-scripting"></a>

Export workspace data for use in CI pipelines, reports, or automation scripts.

```sh
harness list workspace --all --format jsonl | jq -r '.identifier'
```

#### Check workspace status across multiple projects <a href="#check-workspace-status-across-multiple-projects" id="check-workspace-status-across-multiple-projects"></a>

Combine the command with scope flags to audit workspaces in different projects.

```sh
harness list workspace --org <org_id> --project <project_id>
```

#### Plan from a checked-out repository <a href="#plan-from-a-checked-out-repository" id="plan-from-a-checked-out-repository"></a>

Run the plan from the directory that holds your `.harness/workspace.yaml` file so that CI jobs do not need to hard-code a workspace identifier.

```sh
cd <repository_directory>
harness execute workspace --force
```

***

### Related articles <a href="#related-articles" id="related-articles"></a>

* [Continuous Delivery](/harness-platform/use-harness-cli/harness-cli/harness-cli-commands/cd-and-pipeline-commands.md): Manage pipelines and deployment resources.
* [Platform](/harness-platform/use-harness-cli/harness-cli/harness-cli-commands/platform-commands.md): Manage account resources, connectors, and secrets.