Q: How do you handle provider version pinning in Terraform?

In versions.tf: Then run terraform init and commit the .terraform.lock.hcl file. This file locks the exact provider version for all team members and CI. Why pin: provider upgrades can introduce breaking changes. ~> 5.0 is a safe constraint — allows patch updates but not major changes. Never use >= 3.0 without an upper bound — you could suddenly get a breaking major version update. --- ## 🟠 Security & Best Practices

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # allows 5.x, not 6.x
    }
  }
  required_version = ">= 1.5.0"
}