5.3.1. The version Argument

💡 First Principle: The version argument decouples which code from which release of that code — letting the same source track a specific, intentional version — which is only meaningful for sources that publish versions, namely registries.

For registry modules, add version alongside source:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.1.2"     # exact pin
}

You can pin an exact version for maximum stability or use a constraint to allow controlled updates. The same operators apply as for providers (=, >=, ~>, etc.). Best practice for shared/production modules is to pin tightly so upgrades are deliberate.

⚠️ Exam Trap: Repeating the key fact because it's so testable: version works only with registry sources. For local modules it's meaningless (you control the files directly), and for Git/HTTP sources you pin with ?ref= in the URL. An answer attaching version to a Git source is incorrect.

Reflection Question: Why is pinning an exact module version more appropriate for a production module than for one you're actively developing locally?