Certopolis

HashiCorp Certified: Terraform Associate

Module sources, the registry and versions for Terraform Associate

A module block's source tells Terraform where to get the module: a local path starting with ./ or ../, a registry address such as terraform-aws-modules/vpc/aws, a Git repository, or another remote source. The version argument works only for registry modules. For a Git source you pin a release with ?ref= in the source, and the dependency lock file does not record modules.

Source addresses

Local path: source = "./modules/network". Local paths start with ./ or ../. Absolute paths also work but are copied into the module cache, and HashiCorp does not recommend them because they tie the configuration to one computer's layout.

Public Terraform Registry: <NAMESPACE>/<NAME>/<PROVIDER>. In terraform-aws-modules/vpc/aws, the last segment, aws, is the provider the module is written for. HCP Terraform's private registry uses app.terraform.io/<NAMESPACE>/<NAME>/<PROVIDER>, and Terraform Enterprise uses its own hostname in front.

Git: for example git::https://example.com/vpc.git or git::ssh://.... A module in a subdirectory of a repository or archive uses //, as in git::https://example.com/network.git//modules/vpc. Query parameters such as ref go after the subdirectory.

Choosing a version

Registry modules take a version argument with a version constraint. Terraform uses the newest installed version that meets it, and downloads the newest matching version if none is installed. HashiCorp recommends constraining versions explicitly.

version does not apply to other sources. Local modules share their caller's version. A Git source uses the default branch unless you add ?ref= with a tag, branch or commit SHA, for example git::https://example.com/vpc.git?ref=v1.2.0. Adding depth=1 makes a shallow clone.

An input variable used in source or version must set const = true, because Terraform needs the value during init, before it evaluates most variables.

Installing and using a module

terraform init downloads module sources into a hidden subdirectory of the working directory. Run init again after changing source or version. Add -upgrade to move installed modules to the newest version the constraint allows.

Inputs are arguments in the module block. Outputs are read as module.<NAME>.<OUTPUT>, so a value the module does not output cannot be reached. A module block also accepts count, for_each and depends_on, and can be given a non-default provider configuration.

The lock file and modules

The dependency lock file, .terraform.lock.hcl, currently tracks only provider dependencies. Terraform does not remember module version selections, so it always selects the newest module version that meets the constraint.

To make every machine install the same registry module version, use an exact version constraint. For a Git module, pin ?ref= to a tag or commit.

Where the exam catches people

  • Believing version works on a Git source: it applies only to registry modules. Pin Git modules with ?ref=.
  • Believing .terraform.lock.hcl pins module versions: it records providers only.
  • Believing the last part of terraform-aws-modules/vpc/aws is a version or name: it is the provider the module targets.
  • Believing source = "modules/network" is a local path: local paths begin with ./ or ../.
  • Believing a changed module version takes effect on the next plan: run terraform init again first.

Written from HashiCorp's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A registry module source reads terraform-aws-modules/vpc/aws. Which of the following does the final segment name?

    Right. In the game that’s Renown for your Terraform modules building.

    Not that one: B is right. In the game your Terraform modules building would lose a little Renown, and this question would come back later.

    Written from developer.hashicorp.com/terraform/language/modules/configuration

  2. Every machine should install the same module versions as well as the same provider versions. Which of the following is true?

    Right. In the game that’s Renown for your Terraform modules building.

    Not that one: A is right. In the game your Terraform modules building would lose a little Renown, and this question would come back later.

    Written from developer.hashicorp.com/terraform/language/files/dependency-lock

  3. A module lives in a private Git repository and every machine must install exactly the release the repository tags v1.4.0. Which of the following pins it?

    Right. In the game that’s Renown for your Terraform modules building.

    Not that one: D is right. In the game your Terraform modules building would lose a little Renown, and this question would come back later.

    Written from developer.hashicorp.com/terraform/language/block/module