Pin the AWS provider version and commit the lock file #181

Overview

We need the AWS provider version pinned and .terraform.lock.hcl committed, because this repository declares no required_providers block at all and ignores the lock file, so every CI run installs whatever the newest AWS provider happens to be that day. Since this repository manages IAM — users, groups, policies and the OIDC providers other repositories authenticate through — an unreviewed provider upgrade lands on the account's access control.

Action Items

• Confirm the current state before changing anything. There is no required_providers block anywhere in terraform/*.tf, so nothing constrains hashicorp/aws, and .gitignore ignores the lock file (line 25, *.terraform.lock.hcl; accurate 2026-08-30, find it by searching the file for lock.hcl if the line has moved). Confirm git ls-files terraform/.terraform.lock.hcl returns nothing.
• Add a required_providers block to terraform/backend.tf, inside the existing terraform { } block next to required_version, pinning hashicorp/aws with a constraint that fixes major and minor — ~> 6.62.0 against the latest on 2026-08-30. A two-part constraint like ~> 6.62 allows every 6.x and would not fix this. Pin to the same version as hackforla/incubator so the two repositories cannot diverge against the same AWS account.
• Stop ignoring the lock file: remove the *.terraform.lock.hcl line from .gitignore, leaving the .terraform/ directory entries alone.
• Regenerate and commit the lock file with terraform providers lock -platform=linux_amd64 -platform=windows_amd64. Both platforms are required — CI runs on ubuntu-latest while local work is on Windows, and a lock file generated on one platform alone can fail to verify on the other.
• Run terraform plan and confirm it still reports "No changes. Your infrastructure matches the configuration." — which is what it reported on 2026-08-30, so any change appearing after the pin is caused by the pin and must be understood before merging rather than applied.
• After the PR merges, open the next plan run and confirm the log installs the pinned version rather than resolving a fresh one. This cannot be checked from the branch, because the point of the change is what CI does on a later run.

Resources/Instructions

• terraform/backend.tf — has the terraform { } block with required_version but no required_providers; that is where the new block goes.
• .gitignore — the line to remove.
• .github/workflows/terraform-plan.yaml and terraform-apply.yaml — note these authenticate as the IAM user devops-iam-github-action with static access keys rather than OIDC, unlike incubator.
• Found while deleting the Terragrunt state backend in Clean up the Terraform state backend incubator#170; unrelated to that work beyond having surfaced there.
• Pin the AWS provider version and commit the lock file incubator#192 is the identical defect in that repository. Fix both the same way, and pin both to the same version.
• A previous investigation blamed dflook/terraform-plan@v1 for ignoring a committed lock file. That was wrong — there is no committed lock file to ignore. .gitignore line 25 was added 2025-01-22 in 4ff338b, and terraform/.terraform.lock.hcl plus terraform/modules/aws-users/.terraform.lock.hcl were deleted from tracking on 2025-05-14 in f4f3364. The 6.8.0 pin cited at the time was an untracked local file on one machine. dflook installing the latest provider is correct behaviour for a repository with no lock file, so the fix is to give it one rather than to change the action.
• Whether dflook honours a lock file once one is committed is genuinely untested. That is what the post-merge action item above checks, and it is the item that decides whether this ticket actually solved the problem.
• Provider versions were read on 2026-08-30 and will drift.