diff --git a/command/internal_plugin.go b/command/internal_plugin.go
index b26ba1df6..33de8569a 100644
--- a/command/internal_plugin.go
+++ b/command/internal_plugin.go
@@ -33,7 +33,24 @@ func BuildPluginCommandString(pluginType, pluginName string) (string, error) {
 	return strings.Join(parts, TFSPACE), nil
 }
 
+// Internal plugins do not support any CLI args, but we do receive flags that
+// main.go:mergeEnvArgs has merged in from EnvCLI. Instead of making main.go
+// aware of this exception, we strip all flags from our args. Flags are easily
+// identified by the '-' prefix, ensured by the cli package used.
+func StripArgFlags(args []string) []string {
+	argsNoFlags := []string{}
+	for i := range args {
+		if !strings.HasPrefix(args[i], "-") {
+			argsNoFlags = append(argsNoFlags, args[i])
+		}
+	}
+	return argsNoFlags
+}
+
 func (c *InternalPluginCommand) Run(args []string) int {
+	// strip flags from args, only use subcommands.
+	args = StripArgFlags(args)
+
 	if len(args) != 2 {
 		log.Printf("Wrong number of args; expected: terraform internal-plugin pluginType pluginName")
 		return 1
diff --git a/command/internal_plugin_test.go b/command/internal_plugin_test.go
index 83a3f844e..832ec6b15 100644
--- a/command/internal_plugin_test.go
+++ b/command/internal_plugin_test.go
@@ -46,3 +46,12 @@ func TestInternalPlugin_BuildPluginCommandString(t *testing.T) {
 		t.Errorf("Expected command to end with %s; got:\n%s\n", expected, actual)
 	}
 }
+
+func TestInternalPlugin_StripArgFlags(t *testing.T) {
+	actual := StripArgFlags([]string{"provisioner", "remote-exec", "-var-file=my_vars.tfvars", "-flag"})
+	expected := []string{"provisioner", "remote-exec"}
+	// Must be same length and order.
+	if len(actual) != len(expected) || expected[0] != actual[0] || actual[1] != actual[1] {
+		t.Fatalf("Expected args to be exactly '%s', got '%s'", expected, actual)
+	}
+}