Connectors & Variable Sources

Add connectors and configure environment variables, OpenTofu/Terraform variables, and variable files for an IaCM workspace.

Connectors and variable sources define the inputs and integrations a workspace uses when Harness runs Plan, Apply, or Drift detection pipelines. A variable can come from several sources, and Harness resolves conflicts using a clear order of precedence.

What you will learn from this topic

• How to add a connector to a workspace

• How to add environment variables and OpenTofu/Terraform variables, and which value types they support

• How to add a variable file

• How Harness resolves a variable that is defined in more than one place

Before you begin

• Create a workspace to have a workspace to attach connectors and variables to.

• Workspace edit permission: You need Edit Var on IACM Workspaces to add or update connectors and variables. To get this permission, an administrator must assign you a role that includes it. Go to RBAC in Harness and Manage roles to configure roles.

---

Connectors

A connector authenticates a workspace to a cloud provider, Git provider, or secrets manager. Most workspace operations, such as fetching modules or variable files, depend on a connector.

Add a connector

1. Open the workspace, then select the Connectors and Variables tab.

2. In the Connectors panel, select + Add Connector.

3. Select an existing connector from your account, org, or project scope, or select + New Connector to create one.

Supported connectors

Provider	Go to
AWS	Add an AWS connector
GCP	Connect to Google Cloud Platform
Azure	Add a Microsoft Azure connector
HashiCorp Vault (secrets)	Add a HashiCorp Vault connector

Go to What's supported in Harness IaCM for the current list of supported providers. For AWS-specific authentication options, such as OIDC, IRSA, and node role, go to AWS connector authentication.

Multiple connectors

A workspace can use more than one connector, for example to reach both AWS and Azure from the same workspace. A workspace can have only one connector per provider type.

If a workspace uses a workspace template, connectors defined in the template appear automatically and cannot be modified in the workspace. Go to Locked fields to see which template settings are enforced.

---

Variable sources

Harness resolves a variable from one of the following sources, listed from highest to lowest priority:

Priority	Source
1 (highest)	Workspace Template variables
2	Workspace-level variables (environment or OpenTofu/Terraform variables)
3	Variable Sets, in their assigned priority order
4 (lowest)	Default values in your OpenTofu/Terraform code (HCL)

If a variable with the same name exists in more than one source, Harness uses the value from the highest-priority source.

---

Environment variables

Environment variables behave like standard shell variables. Your provisioning logic, module behavior, or CLI tooling can read them at runtime.

Add an environment variable

1. In the Connectors and Variables tab, select + Add Variable in the Environment Variables panel.

2. Enter a Key for the variable name, for example TF_LOG.

3. Select a Type, and enter a Value. Go to Supported variable value types.

# Example: static and runtime-injected environment variables
environmentVariables:
  - key: TF_LOG
    value: INFO
    type: String
    source: CUSTOM
  - key: ENVIRONMENT
    value: <+input>
    type: String
    source: CUSTOM

RUNTIME INPUT

Use <+input> as a value to prompt the pipeline executor for a value at runtime.

---

OpenTofu/Terraform variables

OpenTofu/Terraform variables map to the variable {} blocks declared in your OpenTofu or Terraform code.

AWS CDK WORKSPACES

The Terraform Variables panel still appears for AWS CDK workspaces, but AWS CDK does not consume these variables. Adding or updating a Terraform variable in a CDK workspace has no effect.

Add a Terraform variable

1. In the Connectors and Variables tab, select + Add Variable in the Terraform Variables panel.

2. Enter a Key that matches the variable name declared in your OpenTofu/Terraform code.

3. Select a Type, and enter a Value, or use <+input> to prompt for the value at runtime. Go to Supported variable value types.

# Example: workspace-level Terraform variable
terraformVariables:
  - key: instance_type
    value: t3.large
    type: String
    source: CUSTOM

If you do not set a value in the workspace, Harness falls back to the default defined in your HCL:

# main.tf
variable "instance_type" {
  type    = string
  default = "t3.micro"
}

Supported variable value types

Environment variables and OpenTofu/Terraform variables support the following value types:

• String: Free-form text, for example t3.large.

• Secret: A reference to a Harness secret. Harness masks the value in the UI and logs.

• Number: An integer or decimal value, for example 3 or 0.5.

• Boolean: true or false.

• JSON: A JSON object or array, for example {"env": "prod"}.

Select the type that matches the value your provisioning logic or code expects. Harness validates the value against the selected type when you save the variable.

---

Variable files

Variable files inject multiple variables at once from a .tfvars, .json, or .yaml file stored in Git.

Add a variable file

1. In the Connectors and Variables tab, select + Add File in the Variable Files panel.

2. Select the connector to your Git repository.

3. Select a repository, branch, and file path, for example envs/dev.tfvars.

# Workspace variable file definition
variableFiles:
  - type: Git
    spec:
      connectorRef: account.git_connector
      repoName: terraform-configs
      branch: main
      paths:
        - envs/dev.tfvars

Your variable files and your OpenTofu/Terraform code can come from the same Git repository or from different repositories. You can add more than one variable file to a workspace.

---

Variable sets

A Variable Set is a reusable collection of connectors, environment variables, OpenTofu/Terraform variables, and secrets that you can attach to multiple workspaces from the Connectors and Variables tab.

Go to Variable Sets to create, attach, and prioritize Variable Sets.

---

Troubleshooting

Saving a Number, Boolean, or JSON variable fails with a validation error

The value does not match the selected type. Confirm that a Number value contains only digits (and an optional decimal point), a Boolean value is true or false, and a JSON value is valid JSON, then save the variable again.

Updating a Terraform variable has no effect on an AWS CDK workspace

AWS CDK does not consume the Terraform Variables panel. The panel still appears on an AWS CDK workspace, but any value you add or update there is ignored. Pass values to CDK through its own configuration instead.

A variable is not using the value I expect

The same variable name can be defined in more than one source. Go to Variable sources to check the order of precedence, and confirm whether a Workspace Template or a higher-priority Variable Set is overriding the value you set.

---

Next steps

• Provision your workspace using the connectors and variables you configured.

• Add OPA policies to enforce policy compliance on your workspace.