Provider versioning constraints in Terraform - Commands & Configuration

Introduction

Terraform uses providers to interact with cloud services. Provider versioning constraints help you control which versions of a provider your Terraform code uses, preventing unexpected changes or errors when providers update.

When you want to ensure your Terraform code always uses a tested provider version to avoid breaking changes.

When you need to upgrade a provider version carefully and want to avoid automatic upgrades.

When collaborating with a team to keep everyone using the same provider version.

When running Terraform in automated pipelines where stability is critical.

When using multiple providers and you want to specify compatible versions for each.

Config File - main.tf

main.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.0, < 5.0"
    }
  }
  required_version = ">= 1.3.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket-terraform-12345"
  acl    = "private"
}

terraform block: Defines required providers and Terraform version constraints.

required_providers: Specifies the provider source and version constraints to control which provider versions Terraform can use.

provider "aws": Configures the AWS provider with the region.

resource "aws_s3_bucket": Creates an S3 bucket as an example resource using the specified provider.

Commands

Initializes the Terraform working directory, downloads the specified provider version according to the constraints.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding hashicorp/aws versions matching ">= 4.0, < 5.0"...

- Installing hashicorp/aws v4.62.0...

- Installed hashicorp/aws v4.62.0 (signed by HashiCorp)



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see

any changes that are required for your infrastructure. All Terraform commands

should now work.

Shows the execution plan, verifying that Terraform will create the S3 bucket using the specified provider version.

Terminal

terraform plan

Expected Output

Refreshing Terraform state in-memory prior to plan...



An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:

  + create



Terraform will perform the following actions:



  # aws_s3_bucket.example will be created

  + resource "aws_s3_bucket" "example" {

      + acl    = "private"

      + bucket = "example-bucket-terraform-12345"

      + id     = (known after apply)

    }



Plan: 1 to add, 0 to change, 0 to destroy.



─────────────────────────────────────────────────────────────────────────────



Note: You didn't specify an "-out" parameter to save this plan, so when

"terraform apply" is run, Terraform will execute this plan automatically.

Applies the plan to create the S3 bucket using the provider version constrained in the configuration.

Terminal

terraform apply -auto-approve

Expected Output

aws_s3_bucket.example: Creating...

aws_s3_bucket.example: Creation complete after 2s [id=example-bucket-terraform-12345]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approves the apply without prompting for confirmation.

Key Concept

If you remember nothing else from this pattern, remember: specifying provider version constraints in Terraform ensures your infrastructure uses tested and compatible provider versions, avoiding unexpected failures.

Common Mistakes

Not specifying any provider version constraints.

Terraform may automatically upgrade to a newer provider version that could introduce breaking changes.

Always specify version constraints in the terraform block to control provider versions.

Using overly strict version constraints like exact version pinning (e.g., "= 4.62.0").

This can prevent you from getting important bug fixes or minor improvements in patch versions.

Use range constraints like ">= 4.0, < 5.0" to allow safe upgrades.

Forgetting to run terraform init after changing provider version constraints.

Terraform will not download or update the provider version, causing errors or unexpected behavior.

Always run terraform init after modifying provider version constraints.

Summary

Define provider version constraints in the terraform block to control which provider versions Terraform uses.

Run terraform init to download the correct provider version based on constraints.

Use terraform plan and terraform apply to verify and apply infrastructure changes with the specified provider.

Practice

1. What is the main purpose of setting provider version constraints in Terraform?

easy

A. To speed up Terraform plan execution

B. To keep your infrastructure stable by controlling provider versions

C. To automatically upgrade providers to the latest version

D. To disable provider plugins

Solution

1. Step 1: Understand provider version constraints

   Provider version constraints tell Terraform which versions of a provider it can use.

2. Step 2: Identify the purpose of constraints

   They prevent unexpected changes by locking to specific versions or version ranges, keeping infrastructure stable.

3. Final Answer:

   To keep your infrastructure stable by controlling provider versions -> Option B

4. Quick Check:

   Provider version constraints = stability [OK]

Hint: Constraints keep provider versions stable to avoid surprises [OK]

Common Mistakes:

• Thinking constraints speed up execution
• Assuming constraints auto-upgrade providers
• Believing constraints disable providers

2. Which of the following is the correct syntax to specify a provider version constraint for AWS provider version 4.0 or higher but less than 5.0?

easy

A. terraform { required_providers { aws = ">= 4.0, < 5.0" } }

B. terraform { required_providers { aws = "~> 4.0.0" } }

C. terraform { required_providers { aws = "= 4.0" } }

D. terraform { required_providers { aws = "< 4.0" } }

Solution

1. Step 1: Understand version constraint syntax

   Using ">= 4.0, < 5.0" means versions starting at 4.0 up to but not including 5.0.

2. Step 2: Match syntax to requirement

   terraform { required_providers { aws = ">= 4.0, < 5.0" } } correctly uses this syntax inside the required_providers block.

3. Final Answer:

   terraform { required_providers { aws = ">= 4.0, < 5.0" } } -> Option A

4. Quick Check:

   Range constraint syntax = terraform { required_providers { aws = ">= 4.0, < 5.0" } } [OK]

Hint: Use ">= x, < y" for version ranges [OK]

Common Mistakes:

• Confusing ~> with exact version
• Using = for ranges
• Using < 4.0 instead of >= 4.0

3. Given this Terraform snippet, what provider version will be accepted?

terraform {
  required_providers {
    azurerm = "~> 3.5"
  }
}

medium

A. Any azurerm version 3.0.0 or higher

B. Only azurerm version 3.5.0 exactly

C. Any azurerm version 3.x.x including 4.0.0

D. Any azurerm version 3.5.x, but less than 4.0.0

Solution

1. Step 1: Understand the ~> operator

   The "~> 3.5" means any version starting at 3.5.0 up to but not including 4.0.0.

2. Step 2: Apply to azurerm provider

   So versions like 3.5.1, 3.6.0, 3.9.9 are allowed, but not 4.0.0 or higher.

3. Final Answer:

   Any azurerm version 3.5.x, but less than 4.0.0 -> Option D

4. Quick Check:

   ~> 3.5 means 3.5.x to <4.0.0 [OK]

Hint: ~> means compatible with minor version [OK]

Common Mistakes:

• Thinking ~> means exact version
• Allowing 4.0.0 or higher
• Confusing ~> with >= operator

4. You wrote this Terraform configuration but get an error about provider version conflict:

terraform {
  required_providers {
    google = ">= 3.0, < 4.0"
  }
}

provider "google" {
  version = "4.1.0"
}

What is the cause of the error?

medium

A. The required_providers block syntax is incorrect

B. The provider block is missing required credentials

C. The provider block version 4.1.0 is outside the required_providers constraint range

D. Terraform does not support version constraints

Solution

1. Step 1: Check required_providers constraint

   The constraint requires google provider version >= 3.0 and < 4.0.

2. Step 2: Check provider block version

   The provider block specifies version 4.1.0, which is outside the allowed range.

3. Final Answer:

   The provider block version 4.1.0 is outside the required_providers constraint range -> Option C

4. Quick Check:

   Version conflict due to mismatch [OK]

Hint: Provider version must fit required_providers range [OK]

Common Mistakes:

• Ignoring version mismatch
• Blaming syntax errors
• Assuming missing credentials cause version errors

5. You want to ensure your Terraform configuration always uses the latest patch version of AWS provider 4.12 but never upgrades to 4.13 or higher. Which version constraint should you use?

hard

A. "~> 4.12.0"

B. ">= 4.12.0"

C. "= 4.12.0"

D. "~> 4.12"

Solution

1. Step 1: Understand patch version constraints

   The "~> 4.12.0" means any version starting at 4.12.0 up to but not including 4.13.0, allowing patch updates.

2. Step 2: Compare with other options

   ">= 4.12.0" lacks upper bound, allowing upgrades to 4.13+; "= 4.12.0" locks to exact version; "~> 4.12" allows minor version upgrades beyond 4.12.x.

3. Final Answer:

   "~> 4.12.0" -> Option A

4. Quick Check:

   ~> with patch version locks minor, allows patches [OK]

Hint: Use ~> with patch to allow patch updates only [OK]

Common Mistakes:

• Using = to lock exact version, disallowing patches
• Using ~> 4.12 allowing minor upgrades
• Using lower bound only without upper limit