Chapter 2 · Practice 3 of 4

Pin registry and Git modules to an exact version

Why it matters

Because module versions are not locked, a loose constraint on a third-party module means its next release lands in your next plan without anyone choosing it. The version constraint docs recommend exact pins for third-party modules, and the style guide recommends pinning registry modules to a specific major and minor version at least.

Source	How to pin
Public or private registry	`version = "5.8.1"`
Git	`?ref=v5.8.1` (a tag) or a commit SHA
Local path `./modules/x`	No version: it changes with the repo

Ranges are fine for modules your own organisation maintains with consistent semantic versioning, where you trust the compatibility promise.

Let a bot such as Dependabot or Renovate open pull requests for new module versions, so upgrades are visible and planned one at a time.

Example

HCL

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "6.0.1"

  name = "main"
  cidr = "10.0.0.0/16"
}