Terraform Providers

What is a provider?

A provider is a plugin that knows how to talk to one API. The AWS provider creates EC2 instances and S3 buckets; the Kubernetes provider creates deployments; the GitHub provider creates repositories. There are thousands on the Terraform Registry.

Declaring providers

terraform {
  required_version = ">= 1.6"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"   # any 6.x version
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

terraform init downloads the providers and records their exact versions and checksums in .terraform.lock.hcl.

Version constraints

~> (the "pessimistic" operator) is the usual choice: you get fixes and features, but not breaking major upgrades.

Several regions or accounts: aliases

provider "aws" {
  region = "eu-west-1"
}

provider "aws" {
  alias  = "us"
  region = "us-east-1"
}

resource "aws_s3_bucket" "logs_us" {
  provider = aws.us
  bucket   = "my-logs-us"
}

Credentials

Never put access keys in .tf files. Providers read credentials from the environment (for AWS: AWS_PROFILE, aws sso login, or an IAM role when running in CI or on EC2).