Provider versioning constraints in Terraform - Commands & Configuration

Introduction

Terraform uses providers to interact with cloud services. Provider versioning constraints help you control which versions of a provider your Terraform code uses, preventing unexpected changes or errors when providers update.

When you want to ensure your Terraform code always uses a tested provider version to avoid breaking changes.

When you need to upgrade a provider version carefully and want to avoid automatic upgrades.

When collaborating with a team to keep everyone using the same provider version.

When running Terraform in automated pipelines where stability is critical.

When using multiple providers and you want to specify compatible versions for each.

Config File - main.tf

main.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.0, < 5.0"
    }
  }
  required_version = ">= 1.3.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket-terraform-12345"
  acl    = "private"
}

terraform block: Defines required providers and Terraform version constraints.

required_providers: Specifies the provider source and version constraints to control which provider versions Terraform can use.

provider "aws": Configures the AWS provider with the region.

resource "aws_s3_bucket": Creates an S3 bucket as an example resource using the specified provider.

Commands

Initializes the Terraform working directory, downloads the specified provider version according to the constraints.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding hashicorp/aws versions matching ">= 4.0, < 5.0"...

- Installing hashicorp/aws v4.62.0...

- Installed hashicorp/aws v4.62.0 (signed by HashiCorp)



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see

any changes that are required for your infrastructure. All Terraform commands

should now work.

Shows the execution plan, verifying that Terraform will create the S3 bucket using the specified provider version.

Terminal

terraform plan

Expected Output

Refreshing Terraform state in-memory prior to plan...



An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:

  + create



Terraform will perform the following actions:



  # aws_s3_bucket.example will be created

  + resource "aws_s3_bucket" "example" {

      + acl    = "private"

      + bucket = "example-bucket-terraform-12345"

      + id     = (known after apply)

    }



Plan: 1 to add, 0 to change, 0 to destroy.



─────────────────────────────────────────────────────────────────────────────



Note: You didn't specify an "-out" parameter to save this plan, so when

"terraform apply" is run, Terraform will execute this plan automatically.

Applies the plan to create the S3 bucket using the provider version constrained in the configuration.

Terminal

terraform apply -auto-approve

Expected Output

aws_s3_bucket.example: Creating...

aws_s3_bucket.example: Creation complete after 2s [id=example-bucket-terraform-12345]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approves the apply without prompting for confirmation.

Key Concept

If you remember nothing else from this pattern, remember: specifying provider version constraints in Terraform ensures your infrastructure uses tested and compatible provider versions, avoiding unexpected failures.

Common Mistakes

Not specifying any provider version constraints.

Terraform may automatically upgrade to a newer provider version that could introduce breaking changes.

Always specify version constraints in the terraform block to control provider versions.

Using overly strict version constraints like exact version pinning (e.g., "= 4.62.0").

This can prevent you from getting important bug fixes or minor improvements in patch versions.

Use range constraints like ">= 4.0, < 5.0" to allow safe upgrades.

Forgetting to run terraform init after changing provider version constraints.

Terraform will not download or update the provider version, causing errors or unexpected behavior.

Always run terraform init after modifying provider version constraints.

Summary

Define provider version constraints in the terraform block to control which provider versions Terraform uses.

Run terraform init to download the correct provider version based on constraints.

Use terraform plan and terraform apply to verify and apply infrastructure changes with the specified provider.