Terraform Providers Deep Dive

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.30"
    }
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }
  required_version = ">= 1.8"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      ManagedBy   = "terraform"
      Environment = var.environment
    }
  }
}

# Exact version
version = "5.40.0"

# Minimum version
version = ">= 5.0"

# Pessimistic constraint (5.x only, no 6.0)
version = "~> 5.0"

# Range
version = ">= 5.0, < 6.0"

# Update lock file after changing versions
terraform init -upgrade

# View installed versions
terraform providers

provider "aws" {
  region = "eu-west-1"
  alias  = "ireland"
}

provider "aws" {
  region = "us-east-1"
  alias  = "virginia"
}

# Default provider (no alias) for most resources
provider "aws" {
  region = "eu-west-1"
}

# Use alias for specific resources
resource "aws_s3_bucket" "logs" {
  provider = aws.virginia
  bucket   = "my-logs-us-east-1"
}

# CloudFront requires us-east-1 for certificates
resource "aws_acm_certificate" "cdn" {
  provider    = aws.virginia
  domain_name = "cdn.example.com"
}

# Pass provider to module
module "dr_backup" {
  source = "./modules/backup"
  providers = {
    aws = aws.virginia
  }
}

# Option 1: Environment variables (recommended for CI/CD)
# AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

# Option 2: Shared credentials file
provider "aws" {
  region  = "eu-west-1"
  profile = "production"
}

# Option 3: Assume role
provider "aws" {
  region = "eu-west-1"
  assume_role {
    role_arn     = "arn:aws:iam::123456789012:role/terraform"
    session_name = "terraform-deploy"
  }
}

# Option 4: OIDC (GitHub Actions)
provider "aws" {
  region = "eu-west-1"
  # Uses OIDC token from GitHub Actions
}

provider "kubernetes" {
  # From kubeconfig
  config_path    = "~/.kube/config"
  config_context = "production"
}

# Or from EKS
provider "kubernetes" {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.cluster.token
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }
}

# App on AWS
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
}

# DNS on Cloudflare
resource "cloudflare_record" "app" {
  zone_id = var.cloudflare_zone_id
  name    = "app"
  content = aws_instance.app.public_ip
  type    = "A"
  proxied = true
}

# Backup storage on GCP
resource "google_storage_bucket" "backup" {
  name     = "my-backup-bucket"
  location = "EU"
}

# Enable debug logging
TF_LOG=DEBUG terraform plan

# Provider-specific logging
TF_LOG_PROVIDER=DEBUG terraform apply

# Check provider cache
ls -la .terraform/providers/

# Force reinstall
terraform init -upgrade
rm -rf .terraform/providers/
terraform init

provider "registry.terraform.io/hashicorp/aws" {
  version     = "5.40.0"
  constraints = "~> 5.0"
  hashes = [
    "h1:abc123...",
    "zh:def456...",
  ]
}