Terraform Associate

Deep Dive

D3 · Terraform Core

Terraform Registry: public providers and modules

The Terraform Registry is the centralized repository of reusable providers and modules. Understanding its structure, support tiers, and how to reference modules is essential for the exam.

Contents

Terraform Registry
Provider tiers in the registry
Modules in the public registry
Private registry in HCP Terraform
terraform providers lock

Terraform Registry

registry.terraform.io is the official, public repository where all Terraform providers and modules are published.

When you define source = "hashicorp/aws" in required_providers, Terraform looks for that provider at registry.terraform.io/hashicorp/aws. The registry also hosts thousands of reusable modules ready to use.

Providers

Plugins that connect Terraform with external APIs. The /providers section of the registry.

Modules

Reusable, parameterized configurations. The /modules section of the registry.

Access

Public and free. You only need internet access and terraform init to download.

Versions

Every provider and module has multiple semantic versions available.

Provider tiers in the registry

OfficialMaintained directly by HashiCorp

Namespace

hashicorp/

Examples

aws, azurerm, google, kubernetes, helm, vault, random, null, local, tls

Support guarantee

Maximum — issue tracking, security patches, guaranteed compatibility

PartnerMaintained by a technology company with a commercial agreement with HashiCorp

Namespace

company-namespace/

Examples

DataDog/datadog, mongodb/mongodbatlas, pagerduty/pagerduty, snowflake-labs/snowflake

Support guarantee

High — the company is committed to maintaining the provider

CommunityMaintained by individuals or organizations from the community

Namespace

anyone/

Examples

kreuzwerker/docker, hashicorp/dns (legacy), community-contributed

Support guarantee

Variable — depends on the maintainer, can end up unmaintained

Modules in the public registry

Registry modules follow a standard three-part source format: namespace/name/provider.

# Format: "namespace/module-name/provider"
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"              # ALWAYS version registry modules

  name = "my-vpc"
  cidr = "10.0.0.0/16"
  azs  = ["us-east-1a", "us-east-1b"]
}

# Other examples of registry modules
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"
}

module "security_group" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 5.0"
}

Part of the source	Description	Example
namespace	Organization or user publishing the module	terraform-aws-modules, hashicorp
name	Descriptive name of the module	vpc, eks, security-group, rds
provider	Main provider used by the module	aws, azurerm, google

💡 Verified modules

Modules with the Verified badge in the registry have been reviewed by HashiCorp. They are high-quality, actively maintained modules. Modules under terraform-aws-modules are the most widely used for AWS and all carry the Verified badge.

⚠️ Always pin the version of registry modules

Unlike local modules, registry modules must have a version argument. Without it, Terraform will install the latest version on every terraform init, which can break your config in future runs.

Private registry in HCP Terraform

HCP Terraform (formerly Terraform Cloud) includes a private registry so organizations can publish internal modules in a way similar to the public registry.

Public registry

• registry.terraform.io
• Public and free access
• source = "namespace/module/provider"
• For community modules and providers

Private registry (HCP Terraform)

• app.terraform.io
• Only accessible with an organization token
• source = "app.terraform.io/ORG/module/provider"
• For internal corporate modules

# Module from the HCP Terraform private registry
module "vpc" {
  source  = "app.terraform.io/mi-empresa/vpc/aws"
  version = "~> 2.0"

  # Arguments are the same ones the module defines
  environment = var.environment
  cidr        = var.vpc_cidr
}

terraform providers lock

The terraform providers lock command updates the lock file (.terraform.lock.hcl) with hashes for multiple platforms, without needing to be on each platform.

# Add hashes for multiple platforms to the lock file
# Useful when devs use Mac but CI/CD uses Linux
terraform providers lock   -platform=linux_amd64   -platform=linux_arm64   -platform=darwin_amd64   -platform=darwin_arm64   -platform=windows_amd64

# See which providers the current configuration uses
terraform providers

🎯 For the exam

• The public registry is at registry.terraform.io
• Registry modules use the format namespace/module/provider
• HCP's private registry modules use app.terraform.io/org/module/provider
• Registry modules must ALWAYS include the version argument
• terraform providers lock updates the lock file for new platforms

Did you get this topic?

Test what you just learned

A team wants to use the VPC module from terraform-aws-modules from the public Terraform registry. What is the correct format for the source argument?

Ready to test "Terraform Registry: Public Providers and Modules"?

Put what you learned to the test with original Terraform Associate exam questions.

Start Terraform Associate mock exam

Unlimited mock exams with the Pro plan

PreviousResources, Data Sources and DependenciesProviders and Configuration NextVariables, Locals and OutputsVariables, Outputs and Expressions