Why this matters
Pinned versions and lockfiles ensure reproducible plans and safer rollbacks.
Use version constraints for required_providers and modules, and include .terraform.lock.hcl in PRs that change dependencies.
Pinned versions and lockfiles ensure reproducible plans and safer rollbacks.
Side-by-side examples engineers can pattern-match during review.
terraform {
required_providers {
aws = {}
}
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
}
# (no lockfile in PR)terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0, < 6.0"
}
}
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "5.1.2"
}
# .terraform.lock.hcl added
required_providers { aws = { version = ">= 5.0, < 6.0" } }required_providers { aws = {} }From the same buckets as this rule.