> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins.md).

# IaCM plugins

Configure IaCM plugin behavior using environment variables on your workspace, including proxy trust, pre-baked provisioner binaries, and multi-account AWS OIDC.

IaCM executes provisioner operations through a Harness-managed plugin. The plugin runs automatically as part of IaCM operations, and you configure its behavior by setting environment variables on your workspace. Plugin variables control capabilities such as proxy trust configuration, pre-baked provisioner binary detection, and multi-account AWS authentication.

***

## What is a plugin? <a href="#what-is-a-plugin" id="what-is-a-plugin"></a>

Using a plugin enables IaCM to:

* Run provisioners in an isolated, reproducible environment.
* Configure plugin behavior through environment variables on your workspace.
* Deliver fixes and new capabilities without pipeline changes.
* Run consistently across Harness-hosted and self-managed infrastructure, including environments behind proxies.

***

## Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* You need the **IaCM Workspace Edit** role or higher to add environment variables to a workspace.

***

## Set a plugin environment variable <a href="#set-a-plugin-environment-variable" id="set-a-plugin-environment-variable"></a>

The plugin reads its configuration from the environment variables on your workspace.

1. Navigate to your workspace and select the **Connectors and Variables** tab.
2. In the **Environment Variables** section, select **+ Add Variable**.
3. Set **Type** to **string** or **secret**, depending on the sensitivity of the value.
4. Set **Key** to the full variable name (for example, `PLUGIN_CA_CERT_PATH`) and set the **Value**. Harness passes all workspace environment variables through to the plugin container.
5. Select **Save Changes**.

***

## Plugin environment variables <a href="#plugin-environment-variables-iacm-plugin-reference" id="plugin-environment-variables-iacm-plugin-reference"></a>

The following environment variables are available on the IaCM plugin. Go to a variable's page for its full configuration details.

| **Variable**                                                                                                                                                           | **Applies to**                               | **Description**                                                                                                                                                                                                         |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`PLUGIN_CA_CERT_PATH`](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-ca-cert-path.md)                                     | Terraform, OpenTofu, Terragrunt, and AWS CDK | Trusts a corporate CA certificate for provisioner binary downloads behind a TLS-intercepting proxy.                                                                                                                     |
| [`PLUGIN_BINARY_DIR`](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-binary-dir.md)                                         | Terraform, OpenTofu, and Terragrunt          | Skips the runtime provisioner download by using a pre-baked binary found in the specified directory of a custom image.                                                                                                  |
| [`PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK`](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-provisioner-mirror-no-fallback.md) | Terraform and OpenTofu                       | Routes provisioner binary downloads through Harness Artifact Registry to avoid GitHub API rate limits. Requires Harness to enable the feature flag for your account.                                                    |
| [`PLUGIN_SKIP_MULTIPLE_NETRC`](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-skip-multiple-netrc.md)                       | Terraform, OpenTofu, and Terragrunt          | Writes only the primary Git credential to the netrc file instead of one entry per module connector, which avoids Git module authentication failures when modules use different connectors for the same Git host.        |
| [CDK plugin variables](/infrastructure-as-code-management/use-iacm/iac-provisioners/aws-cdk/cdk-runtime-version.md)                                                    | AWS CDK                                      | Overrides CDK CLI, language runtime, and package manager versions; controls `cdk diff` change set behavior; and configures pre-baked binary paths for locked-down VPC environments. Set as pipeline or stage variables. |

***

## Related concepts <a href="#related-concepts-iacm-related-concepts" id="related-concepts-iacm-related-concepts"></a>

* Go to [Connectors and variable sources](/infrastructure-as-code-management/platform/iacm-connectors-variables/connectors-variables.md) to configure workspace environment variables.
* Go to [Custom images for OpenTofu](/infrastructure-as-code-management/use-iacm/iac-provisioners/opentofu/custom-images.md) to add certificates by building a custom plugin image.
* Go to [Tofu/Terraform Plugin Commands](/infrastructure-as-code-management/use-iacm/iacm-cli-commands/terraform-plugins.md) to review `PLUGIN_` variables for overriding plan step CLI flags such as `-lock`, `-refresh`, and `-target`.
* Go to [AWS connector authentication](/infrastructure-as-code-management/platform/iacm-connectors-variables/aws-connector-auth.md) for `PLUGIN_MULTIPLE_AWS_OIDC_CONNECTOR` and multi-account AWS authentication.

{% @harness-feedback/feedback %}