Terraform Providers, Registry & Version Constraints

1terraform {
2  required_version = ">= 1.5.0"
3
4  required_providers {
5    aws = {
6      source  = "hashicorp/aws"   # registry.terraform.io/hashicorp/aws
7      version = "~> 5.0"          # >= 5.0.0, < 6.0.0
8    }
9    kubernetes = {
10      source  = "hashicorp/kubernetes"
11      version = ">= 2.20.0"
12    }
13    github = {
14      source  = "integrations/github"   # partner provider
15      version = "~> 5.0"
16    }
17    random = {
18      source  = "hashicorp/random"
19      version = "3.5.1"           # exact pin
20    }
21  }
22}

1version = ">= 5.0, < 6.0"     # equivalent to ~> 5.0
2version = ">= 4.0, != 4.3.0"  # exclude a broken version

1# ~> 5.0     means >= 5.0, < 6.0   (minor and patch updates allowed)
2# ~> 5.3     means >= 5.3, < 6.0   (patch updates only within 5.x)
3# ~> 5.3.1   means >= 5.3.1, < 5.4 (only patch updates within 5.3.x)
4
5terraform {
6  required_providers {
7    aws = {
8      source  = "hashicorp/aws"
9      version = "~> 5.0"    # allows 5.1, 5.2, 5.99... but NOT 6.0
10    }
11  }
12}

1# .terraform.lock.hcl  — COMMIT THIS TO GIT
2provider "registry.terraform.io/hashicorp/aws" {
3  version     = "5.31.0"
4  constraints = "~> 5.0"
5  hashes = [
6    "h1:abc123...",   # hash of the provider binary
7    "zh:def456...",
8  ]
9}

1# First time or add a new provider
2terraform init
3
4# Upgrade providers to latest allowed by constraints
5terraform init -upgrade
6
7# After a colleague changes version constraints in .tf files
8git pull && terraform init

1# Basic AWS provider
2provider "aws" {
3  region = "us-east-1"
4}
5
6# With explicit credentials (not recommended — use env vars or instance profile)
7provider "aws" {
8  region     = "us-east-1"
9  access_key = var.aws_access_key   # avoid hardcoding
10  secret_key = var.aws_secret_key
11}
12
13# With assume_role (recommended for cross-account)
14provider "aws" {
15  region = "us-east-1"
16
17  assume_role {
18    role_arn     = "arn:aws:iam::123456789012:role/TerraformDeployRole"
19    session_name = "terraform-deploy"
20    external_id  = var.external_id   # for third-party accounts
21  }
22}

1# Environment variable authentication (CI/CD)
2export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
3export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
4export AWS_DEFAULT_REGION="us-east-1"
5
6# Profile authentication (local dev)
7export AWS_PROFILE="my-terraform-profile"
8
9# No provider block needed — Terraform picks up env vars automatically

1# Default provider (no alias)
2provider "aws" {
3  region = "us-east-1"
4}
5
6# Aliased provider — secondary region
7provider "aws" {
8  alias  = "us_west"
9  region = "us-west-2"
10}
11
12# Aliased provider — different AWS account via assume_role
13provider "aws" {
14  alias  = "prod_account"
15  region = "us-east-1"
16  assume_role {
17    role_arn = "arn:aws:iam::999999999999:role/TerraformRole"
18  }
19}
20
21# Resources use the default provider unless specified
22resource "aws_instance" "east" {
23  ami           = "ami-0c55b159cbfafe1f0"
24  instance_type = "t3.micro"
25  # uses default provider (us-east-1)
26}
27
28resource "aws_instance" "west" {
29  provider      = aws.us_west   # explicitly select aliased provider
30  ami           = "ami-0892d3c7ee96c0bf7"
31  instance_type = "t3.micro"
32}
33
34# Route 53 ACM certificate validation (classic multi-region pattern)
35resource "aws_acm_certificate" "cert" {
36  provider          = aws.us_east_1  # ACM for CloudFront must be in us-east-1
37  domain_name       = "example.com"
38  validation_method = "DNS"
39}

1module "replica" {
2  source = "./modules/database"
3
4  providers = {
5    aws = aws.us_west   # override the module's default provider
6  }
7}

1# Directory structure after terraform init
2.terraform/
3  providers/
4    registry.terraform.io/
5      hashicorp/
6        aws/
7          5.31.0/
8            linux_amd64/
9              terraform-provider-aws_v5.31.0_x5   # provider binary
10  terraform.tfstate       # backend config cache
11
12.terraform.lock.hcl       # committed to Git

1resource "aws_s3_bucket" "logs" {
2  provider = aws.us_west   # format: <provider_name>.<alias>
3  bucket   = "my-logs-us-west"
4}
5
6# In a module, if the module accepts provider aliases:
7module "cdn" {
8  source = "./modules/cdn"
9
10  providers = {
11    aws           = aws                  # default
12    aws.us_east_1 = aws.cert_region     # required by module for ACM
13  }
14}