HashiCorp Certified: Terraform Associate free question 2 / 10 · Domain 2: Terraform fundamentals
A configuration has version = ">= 4.5.0" for the AWS provider, and its committed lock file records 4.5.0. Newer AWS provider releases now exist. A teammate clones the repository and runs terraform init. Which version is installed?
- Version 4.5.0, because a version recorded in the lock file is selected again.
- The newest release that is at least 4.5.0, because the constraint allows it.
- No version, because init stops until the lock file and the constraint agree.
- The newest release, and the lock file is rewritten to record that new version.
Show the answer and explanation
Answer: A
Why this is correct
Under "Dependency Installation Behavior", the lock file page explains that terraform init considers both the version constraints in the configuration and the selections recorded in the lock file. If a provider has no recorded selection, Terraform selects the newest version that matches the constraint and records it. If a provider already has a selection recorded in the lock file, Terraform will always re-select that version for installation, even if a newer version has become available. You override that by adding -upgrade to terraform init, in which case Terraform disregards the existing selections and selects the newest matching version again. The Lock and upgrade provider versions tutorial shows the same table: with >= 4.5.0, init without a lock file takes the latest release, and init with the lock file takes 4.5.0.
Why the other options are wrong
"The newest release that is at least 4.5.0, because the constraint allows it." … Picking the newest matching release is what happens for a provider that has no recorded selection yet. The lock file page says that in that case Terraform selects the newest available version that matches the constraint and then records it; here a selection is already recorded.
"The newest release, and the lock file is rewritten to record that new version." … Moving to a newer release is what the -upgrade option of terraform init does: Terraform then disregards the existing selections and once again selects the newest available version matching the constraint. A plain init keeps the recorded one.
"No version, because init stops until the lock file and the constraint agree." … There is no conflict to resolve: 4.5.0 satisfies >= 4.5.0. The lock file tutorial shows this exact case in its table, where the lock file version 4.5.0 is installed while init without a lock file would take the latest release.
Constraint versus selection
The constraint says which versions are acceptable; the lock file says which one was chosen. Without -upgrade, a recorded choice wins over a newer acceptable release.