Task 3.9: Manage provider and module versions

• A5.80.7

  Correct

  ~> allows only the right-most component to increment, so 5.80.x releases qualify, and -upgrade takes the newest one that matches.

• B5.81.0

  Incorrect

  With three components, ~> 5.80.0 does not allow the minor version to increase.

• C5.80.3, the version already recorded in the lock file

  Incorrect

  -upgrade disregards the recorded selection and chooses the newest version that matches the constraints.

• DAn error about the constraint conflicting with the lock file

  Incorrect

  The recorded version also satisfies the constraint, so there is no conflict; -upgrade simply re-selects.

"~> 5.80.0" means at least 5.80.0 and below 5.81.0. init -upgrade ignores the lock file's selection and records the newest matching version.

• Aapp.terraform.io/<ORG>/<NAME>/<PROVIDER> on every instance

  Incorrect

  app.terraform.io is the HCP Terraform SaaS host, not a self-managed instance.

• BA relative path to a vendored copy of each module in the repository

  Incorrect

  Local copies drop registry versioning, and the company wants to keep using its registries.

• Clocalterraform.com/<ORG>/<NAME>/<PROVIDER> in every source

  Correct

  The generic hostname localterraform.com makes Terraform request the module from the instance it runs on.

• DA credentials block named after each instance's hostname

  Incorrect

  Credentials authenticate to a host; they do not change which host a source address names.

CLI-driven workflows need Terraform v1.4 or later for the generic hostname, and testing on a workstation without the remote backend means swapping in a literal hostname. HashiCorp recommends it mainly for organizations with several Terraform Enterprise instances.

• Aconst = true

  Correct

  version can reference constant input variables and local values; any variable it references must declare const = true.

• Bsensitive = false

  Incorrect

  Sensitivity is not what decides whether version can use a variable.

• Cnullable = false

  Incorrect

  nullable controls null handling, not constant evaluation.

• Dephemeral = true

  Incorrect

  ephemeral does not make a value usable while Terraform installs modules.

Constant variables are known before init, so Terraform can choose module versions from them.

• AHCP Terraform can clone private modules only from GitHub.com repositories

  Incorrect

  Other Git hosts work; the limit is how HCP Terraform authenticates.

• BHCP Terraform runs can authenticate to Git only with SSH keys

  Correct

  For Terraform operations in HCP Terraform you can only authenticate with SSH keys, so switch the sources to SSH and add a key.

• CRemote runs need ref to name a tag, not a branch, to clone

  Incorrect

  ref can name a branch, a tag or a commit hash; the failure is authentication.

• DGit module sources need depth=1 when they run remotely

  Incorrect

  depth makes a shallow clone; it does not supply credentials.

Runners clone with their local Git configuration and credentials, which remote runs in HCP Terraform do not have. An SSH source with a key added to HCP Terraform works in both places.

• Aterraform get

  Incorrect

  Without -update, get does not check modules that are already downloaded.

• Bterraform providers lock

  Incorrect

  That records provider checksums.

• Cterraform validate

  Incorrect

  validate checks configuration and does not download modules.

• Dterraform get -update

  Correct

  -update checks downloaded modules for updates and downloads them if present.

Review version constraints before updating, since modules move to the newest allowed version.