> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/infrastructure-as-code-management/3.0/troubleshooting-and-resources/faq.md).

# FAQ — Harness IaCM

This page answers common questions about Harness Infrastructure as Code Management (IaCM). Go to the [IaCM overview](/infrastructure-as-code-management/3.0/new-to-iacm/overview.md) to understand how workspaces, provisioners, and pipelines fit together.

***

### Provisioners and versions <a href="#provisioners-and-versions" id="provisioners-and-versions"></a>

<details>

<summary>Which Terraform versions does IaCM support?</summary>

Harness IaCM supports MPL-licensed Terraform up to **1.5.x** only. BSL-licensed releases, meaning **1.6.0** and later, are not supported. If you are on Terraform 1.6 or above, use OpenTofu as a drop-in replacement.

Go to [What is supported in IaCM](/infrastructure-as-code-management/3.0/troubleshooting-and-resources/whats-supported.md) to review provisioner version support.

</details>

***

### Workspaces <a href="#workspaces" id="workspaces"></a>

<details>

<summary>Can we use multiple workspaces in a single stage?</summary>

No, a single stage is limited to one workspace. A pipeline can include multiple stages, however, and each stage can reference a different workspace. You select the workspace when you configure the Infrastructure as Code Management stage, so you handle multiple workspaces by chaining stages, each performing specific tasks on its assigned workspace.

Go to [Provision workspace](/infrastructure-as-code-management/3.0/platform/workspaces/provision-workspace.md) to configure a stage and select its workspace.

</details>

***

### Module registry <a href="#module-registry" id="module-registry"></a>

<details>

<summary>Can the same module be used with OpenTofu and Terraform?</summary>

Yes, modules are agnostic and can be used with either an OpenTofu or Terraform provisioner. The registry parses and versions the module the same way regardless of which provisioner consumes it.

Go to the [module registry overview](/infrastructure-as-code-management/3.0/registry/module-registry/module-registry-overview.md) to publish and version reusable modules.

</details>

***

### Drift detection <a href="#drift-detection" id="drift-detection"></a>

<details>

<summary>Why does drift detection report more changes than a plan?</summary>

Drift detection and planning answer different questions, so they report different results. Harness runs `tofu plan -refresh-only` for drift detection, which surfaces every change made outside of OpenTofu, including metadata such as `updated_at` values. A normal `tofu plan`, and the equivalent Harness step, only reports differences that affect bringing your infrastructure in line with your configuration, so it reports no changes when your configuration already matches state. This is by design in OpenTofu, so drift detection legitimately shows more changes than you might expect.

When drift is found, the pipeline fails and flags the affected resources in the **Resources** tab. To reconcile state without applying unrelated configuration changes, use a `plan-refresh-only` step.

Go to [drift detection](/infrastructure-as-code-management/3.0/platform/iacm-pipelines/content/drift-detection.md) to build a drift pipeline and review drift details.

</details>

***

### Remote backends and state <a href="#remote-backends-and-state" id="remote-backends-and-state"></a>

<details>

<summary>Which remote state backends does IaCM support?</summary>

When your code contains no backend block, IaCM automatically uses Harness-managed state storage. You can also point a workspace at an existing **AWS S3**, **Google Cloud Storage**, or **Azure Blob Storage** backend by committing a `backends.tf` file, with no migration required. A separate `http` backend block lets you reach Harness-managed state from outside a pipeline.

Go to [Use existing remote state](/infrastructure-as-code-management/3.0/use-iacm/remote-backends/use-backends.md) to connect an existing backend, or [State migration](/infrastructure-as-code-management/3.0/use-iacm/remote-backends/state-migration.md) to move state into Harness.

</details>

<details>

<summary>Does Harness support the `cloud {}` configuration block?</summary>

No. The `cloud` block was designed for Terraform Cloud and Enterprise, and OpenTofu retains it only for backward compatibility. IaCM does not honor it, so remove any `cloud` block before running your configuration in a workspace.

To run operations against a workspace, use a pipeline or the Harness CLI, for example `harness execute workspace <workspace-id>`. To inspect or modify state locally, copy the `http` backend block from the workspace **CLI Integration** tab into a temporary `backend.tf` file, add that file to `.gitignore` so it does not conflict with pipeline runs, and remove it after inspection.

Go to the [Harness CLI reference](/infrastructure-as-code-management/3.0/use-iacm/iacm-cli-commands/harness-cli.md) to review the available commands, and [CLI integration](/infrastructure-as-code-management/3.0/platform/workspaces/cli-integration.md) to copy your workspace backend block.

</details>

<details>

<summary>How is state locking handled?</summary>

Each backend implements its own locking mechanism, and OpenTofu acquires and releases the lock during pipeline execution. S3 uses DynamoDB, GCS uses object metadata, and Azure Blob Storage uses leases. IaCM adds no locking layer of its own, so a stuck lock is resolved through the backend rather than through Harness.

Go to [state locking considerations](/infrastructure-as-code-management/3.0/use-iacm/remote-backends/use-backends.md#state-locking-considerations) to configure locking for your backend.

</details>

***

### Costs and billing <a href="#costs-and-billing" id="costs-and-billing"></a>

<details>

<summary>Can drift detection incur additional costs?</summary>

No, usage charges are only incurred when an `apply` changes resources. The `plan` command and drift detection are free.

</details>