Installing, Versioning and Using Providers

What it is

A provider is a plugin that lets Terraform manage one platform, such as AWS, Azure, Kubernetes or GitHub. It defines the resource types and data sources you can use and makes the API calls behind them.

Providers are not part of the Terraform binary. You declare them in the terraform block, terraform init downloads them, and the dependency lock file records exactly which versions were chosen.

How it works

Declaring and versioning providers

terraform {
  required_version = ">= 1.12.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

required_version constrains the Terraform CLI version itself. Each entry in required_providers gives a local name (aws), a source address and a version constraint.

The source address has the form [HOSTNAME/]NAMESPACE/TYPE. When the hostname is left out, it defaults to the public Terraform Registry, registry.terraform.io, so hashicorp/aws means registry.terraform.io/hashicorp/aws.

The ~> operator, the pessimistic constraint, lets only the rightmost version part increase. It is the common choice for staying on one major version.

The dependency lock file

terraform init writes .terraform.lock.hcl in the configuration directory. It records the exact provider version selected and checksums for its packages, and you should commit it to version control.

On the next terraform init, Terraform reuses the locked version even if a newer one matches the constraint. To move to the newest version the constraints allow, run:

terraform init -upgrade

The lock file tracks provider versions only. Module versions are not recorded there.

How Terraform uses providers

Terraform core reads the configuration, builds the dependency graph and decides what to change. It then calls the provider plugin, which talks to the platform API to create, read, update or delete each object.

Every resource type belongs to a provider by its name prefix: aws_instance uses the aws provider and azurerm_resource_group uses azurerm. Providers on the Registry are labeled by tier: official (HashiCorp), partner (third-party companies) and community.

A provider block configures a provider, for example the region. Keep credentials out of it; use environment variables or the platform's normal credential sources instead.

Several providers and aliases

A configuration can declare as many providers as it needs, each in required_providers. To use the same provider with two different settings, add a second provider block with an alias.

provider "aws" {
  region = "us-east-1"
}
provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

resource "aws_s3_bucket" "replica" {
  provider = aws.west
  bucket   = "example-replica-bucket"
}

The block without alias is the default configuration. Resources without a provider argument use it; the bucket above uses the aliased one through provider = aws.west.

Child modules can be given an aliased provider with the providers map:

module "dr_site" {
  source = "./modules/site"
  providers = {
    aws = aws.west
  }
}

How the exam asks about this

• "Init kept provider 6.1.0 although 6.4.0 is available and allowed." The lock file pins 6.1.0; run terraform init -upgrade.
• "Which constraint allows 6.x but never 7.0?" ~> 6.0 (or >= 6.0, < 7.0).
• "Resources must be created in two AWS regions from one configuration." Add a second provider "aws" block with an alias and set provider = aws.<alias> on those resources.