> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/infrastructure-as-code-management/platform/iacm-connectors-variables/connectors-variables.md).

# Connectors & Variable Sources

Add connectors and configure environment variables, OpenTofu/Terraform variables, and variable files for an IaCM workspace.

**Connectors** and **variable sources** define the inputs and integrations a workspace uses when Harness runs **Plan**, **Apply**, or **Drift detection** pipelines. A variable can come from several sources, and Harness resolves conflicts using a clear order of precedence.

## What you will learn from this topic

* How to add a connector to a workspace
* How to add environment variables and OpenTofu/Terraform variables, and which value types they support
* How to add a variable file
* How Harness resolves a variable that is defined in more than one place

## Before you begin

* [Create a workspace](/infrastructure-as-code-management/platform/workspaces/create-workspace.md) to have a workspace to attach connectors and variables to.
* **Workspace edit permission:** You need **Edit Var** on [IACM Workspaces](/harness-ai/use-harness-platform/platform-access-control/permissions-reference.md#infrastructure-as-code) to add or update connectors and variables. To get this permission, an administrator must assign you a role that includes it. Go to [RBAC in Harness](/harness-ai/use-harness-platform/platform-access-control.md) and [Manage roles](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md) to configure roles.

***

## Connectors

A connector authenticates a workspace to a cloud provider, Git provider, or secrets manager. Most workspace operations, such as fetching modules or variable files, depend on a connector.

### Add a connector

1. Open the workspace, then select the **Connectors and Variables** tab.
2. In the **Connectors** panel, select **+ Add Connector**.
3. Select an existing connector from your account, org, or project scope, or select **+ New Connector** to create one.

### Supported connectors

| Provider                  | Go to                                                                                                                                   |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| AWS                       | [Add an AWS connector](/harness-ai/use-harness-platform/connectors/cloud-providers/add-aws-connector.md)                                |
| GCP                       | [Connect to Google Cloud Platform](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp.md) |
| Azure                     | [Add a Microsoft Azure connector](/harness-ai/use-harness-platform/connectors/cloud-providers/add-a-microsoft-azure-connector.md)       |
| HashiCorp Vault (secrets) | [Add a HashiCorp Vault connector](/harness-ai/use-harness-platform/secrets/secrets-management/add-hashicorp-vault.md)                   |

Go to [What's supported in Harness IaCM](/infrastructure-as-code-management/troubleshooting-and-resources/whats-supported.md) for the current list of supported providers. For AWS-specific authentication options, such as OIDC, IRSA, and node role, go to [AWS connector authentication](/infrastructure-as-code-management/platform/iacm-connectors-variables/aws-connector-auth.md).

### Multiple connectors

A workspace can use more than one connector, for example to reach both AWS and Azure from the same workspace. A workspace can have only one connector per provider type.

If a workspace uses a workspace template, connectors defined in the template appear automatically and cannot be modified in the workspace. Go to [Locked fields](/infrastructure-as-code-management/platform/workspaces/workspace-templates.md#locked-fields) to see which template settings are enforced.

***

## Variable sources

Harness resolves a variable from one of the following sources, listed from highest to lowest priority:

| Priority    | Source                                                                  |
| ----------- | ----------------------------------------------------------------------- |
| 1 (highest) | Workspace Template variables                                            |
| 2           | Workspace-level variables (environment or OpenTofu/Terraform variables) |
| 3           | Variable Sets, in their assigned priority order                         |
| 4 (lowest)  | Default values in your OpenTofu/Terraform code (HCL)                    |

If a variable with the same name exists in more than one source, Harness uses the value from the highest-priority source.

***

## Environment variables

Environment variables behave like standard shell variables. Your provisioning logic, module behavior, or CLI tooling can read them at runtime.

### Add an environment variable

1. In the **Connectors and Variables** tab, select **+ Add Variable** in the **Environment Variables** panel.
2. Enter a **Key** for the variable name, for example `TF_LOG`.
3. Select a **Type**, and enter a **Value**. Go to [Supported variable value types](#supported-variable-value-types).

```yaml
# Example: static and runtime-injected environment variables
environmentVariables:
  - key: TF_LOG
    value: INFO
    type: String
    source: CUSTOM
  - key: ENVIRONMENT
    value: <+input>
    type: String
    source: CUSTOM
```

{% hint style="info" %}
**RUNTIME INPUT**

Use `<+input>` as a value to prompt the pipeline executor for a value at runtime.
{% endhint %}

***

## OpenTofu/Terraform variables

OpenTofu/Terraform variables map to the `variable {}` blocks declared in your OpenTofu or Terraform code.

{% hint style="warning" %}
**AWS CDK WORKSPACES**

The **Terraform Variables** panel still appears for AWS CDK workspaces, but AWS CDK does not consume these variables. Adding or updating a Terraform variable in a CDK workspace has no effect.
{% endhint %}

### Add a Terraform variable

1. In the **Connectors and Variables** tab, select **+ Add Variable** in the **Terraform Variables** panel.
2. Enter a **Key** that matches the variable name declared in your OpenTofu/Terraform code.
3. Select a **Type**, and enter a **Value**, or use `<+input>` to prompt for the value at runtime. Go to [Supported variable value types](#supported-variable-value-types).

```yaml
# Example: workspace-level Terraform variable
terraformVariables:
  - key: instance_type
    value: t3.large
    type: String
    source: CUSTOM
```

If you do not set a value in the workspace, Harness falls back to the `default` defined in your HCL:

```hcl
# main.tf
variable "instance_type" {
  type    = string
  default = "t3.micro"
}
```

### Supported variable value types

Environment variables and OpenTofu/Terraform variables support the following value types:

* **String**: Free-form text, for example `t3.large`.
* **Secret**: A reference to a Harness secret. Harness masks the value in the UI and logs.
* **Number**: An integer or decimal value, for example `3` or `0.5`.
* **Boolean**: `true` or `false`.
* **JSON**: A JSON object or array, for example `{"env": "prod"}`.

Select the type that matches the value your provisioning logic or code expects. Harness validates the value against the selected type when you save the variable.

***

## Variable files

Variable files inject multiple variables at once from a `.tfvars` (HCL) or `.json` file stored in Git.

### Add a variable file

1. In the **Connectors and Variables** tab, select **+ Add File** in the **Variable Files** panel.
2. Select the connector to your Git repository.
3. Select a repository, branch, and file path, for example `envs/dev.tfvars`.

```yaml
# Workspace variable file definition
variableFiles:
  - type: Git
    spec:
      connectorRef: account.git_connector
      repoName: terraform-configs
      branch: main
      paths:
        - envs/dev.tfvars
```

{% hint style="info" %}
Your variable files and your OpenTofu/Terraform code can come from the same Git repository or from different repositories. You can add more than one variable file to a workspace.
{% endhint %}

***

## Variable sets

A Variable Set is a reusable collection of connectors, environment variables, OpenTofu/Terraform variables, and secrets that you can attach to multiple workspaces from the **Connectors and Variables** tab.

Go to [Variable Sets](/infrastructure-as-code-management/platform/iacm-connectors-variables/variable-sets.md) to create, attach, and prioritize Variable Sets.

***

## Troubleshooting

<details>

<summary>Saving a Number, Boolean, or JSON variable fails with a validation error</summary>

The value does not match the selected type. Confirm that a **Number** value contains only digits (and an optional decimal point), a **Boolean** value is `true` or `false`, and a **JSON** value is valid JSON, then save the variable again.

</details>

<details>

<summary>Updating a Terraform variable has no effect on an AWS CDK workspace</summary>

AWS CDK does not consume the **Terraform Variables** panel. The panel still appears on an AWS CDK workspace, but any value you add or update there is ignored. Pass values to CDK through its own configuration instead.

</details>

<details>

<summary>A variable is not using the value I expect</summary>

The same variable name can be defined in more than one source. Go to [Variable sources](#variable-sources) to check the order of precedence, and confirm whether a Workspace Template or a higher-priority Variable Set is overriding the value you set.

</details>

***

## Next steps

* [Provision your workspace](/infrastructure-as-code-management/platform/workspaces/provision-workspace.md) using the connectors and variables you configured.
* [Add OPA policies](/infrastructure-as-code-management/platform/policy-and-governance/opa-workspace.md) to enforce policy compliance on your workspace.

{% @harness-feedback/feedback %}