Terraform · Infrastructure as code

What are Terraform providers and how do you configure them?

Easyproviderspluginsversion constraintsUpdated Oct 2026

Short answer

Providers are plugins that translate Terraform resources and data sources into API calls. Declare them in required_providers, configure them per environment, and pin versions for reproducible runs.

Terraform core does not know how to create an S3 bucket or a Kubernetes deployment. A provider implements the API calls for one platform. The registry supplies the plugin, and the configuration block supplies region, credentials and other defaults.

hcl

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.60"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "eu"
  region = "eu-west-1"
}

resource "aws_s3_bucket" "eu_logs" {
  provider = aws.eu
  bucket   = "acme-eu-logs"
}

Aliases let one configuration target several regions or accounts.

Configuration rules

A provider without an alias is the default for its type
Child modules inherit the default provider unless passed explicitly
Credentials should come from the environment, SSO or workload identity
Provider configuration belongs in the root module, not in reusable modules

Provider versions change resource behaviour. The pessimistic constraint allows patch and minor updates within a major version, while the lock file records the exact build used. Upgrade providers in a separate change so a plan can reveal unexpected diffs.

Never hardcode access keys in a provider block. Use environment variables, AWS SSO, instance roles or OIDC federation in CI.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

1What is a provider alias used for?
2How do child modules receive providers?
3Why commit the dependency lock file?
4How should CI authenticate to a cloud provider?

Say it in the interview

Providers are plugins that map Terraform resources to a platform API. I declare the source and version constraint in required_providers, configure the default provider in the root module, and use aliases when I need a second region or account. Credentials come from the environment or workload identity, never from hardcoded keys, and I pin provider versions so plans stay reproducible.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.

Start a free Terraform interview Browse all questions

Configuration rules

Follow-ups you should expect

Related questions

Now say it out loud.