manage-iacm

Manage IaCM

Configure Terraform workspaces, drift detection, change approval workflows, and cost estimation in Harness Infrastructure as Code Management.

Instructions

Step 1: Establish Scope

Confirm the user's org, project, cloud provider, and environments.

Call MCP tool: harness_list
Parameters:
  resource_type: "project"
  org_id: "<organization>"

Step 2: Identify the IaCM Task

Determine which workflow the user needs:

1. Workspace and State Management -- Workspace structure, remote state, RBAC, module registry
2. Drift Detection -- Continuous drift scanning with remediation workflows
3. Change Approval Workflows -- Risk-based approval tiers for infrastructure changes
4. Cost Estimation -- Pre-deployment cost impact analysis using Infracost

Step 3: Configure Workspaces and State Management

Gather from the user:

• Cloud provider (AWS, GCP, Azure, multi-cloud)
• Environments to manage (dev, staging, prod)
• Workspace naming convention (e.g., {project}-{env}-{region})
• State backend preference (S3+DynamoDB, GCS+Firestore, Azure Blob, Harness built-in)

Design workspace structure:

• One workspace per environment per account
• Remote state backend with encryption at rest and state locking
• State backup with versioning and configurable retention
• RBAC: Developer=plan only, Senior Dev=plan+apply to dev, Team Lead=staging, DevOps=all with prod approval

Configure module registry:

• Semantic versioning for modules
• Security scanning before module publication (Checkov, tfsec, Terrascan)
• Approval workflow for new module versions

Step 4: Set Up Drift Detection

Gather from the user:

• Environments to monitor
• Scan frequency (hourly, every 6 hours, daily)
• Resources to exclude from drift scanning

Configure drift detection:

• Compare actual cloud resources against Terraform state on schedule
• Detect additions, deletions, and modifications outside Terraform control
• Classify drift by severity: critical (security group changes, IAM), warning (tags, descriptions), info (metadata)