Terraform interview question · Most asked
How do you pin provider and module versions, and what is the dependency lock file?
Summary
Declare required_providers with version constraints (for example ~> 5.0) and required_version for Terraform itself; pin module versions; and commit .terraform.lock.hcl, which records the exact provider versions and checksums chosen by init, so every machine and pipeline uses the same provider builds.
Longer Answer
Upgrade deliberately with terraform init -upgrade in a branch, read provider changelogs (major versions often change resource behaviour), and review the plan. Unpinned providers cause surprise changes when a new major version is released. Generate lock-file hashes for every platform your team uses (terraform providers lock -platform=...) to avoid mismatches between macOS laptops and Linux CI.
Key Points
- required_providers + required_version.
- Commit .terraform.lock.hcl.
- Upgrade deliberately; read changelogs.
- Lock hashes for all platforms.
More most-asked Terraform questions
- How do you handle secrets in Terraform?
- How would you run Terraform in CI/CD?
- What is Terraform state, why is it needed, and where should it be stored?
- count or for_each: when do you use each?
- Walk through terraform init, plan and apply. What does each do?
- What is Terraform, and how does it work at a high level?
- What are Terraform modules, and how do you design good ones?
- A terraform plan wants to destroy and recreate a database. What do you do?