How to pin Terraform provider version constraints to a single patch release

[zackproser]

A customer asked:

How do I pin my terraform provider to a single patch release, e.g., 2.71.1?

[zackproser]

To pin to a specific "patch" version release using semantic versioning, you can use an equal sign in front of the exact version you want installed:

provider "aws" {

  region = var.aws_region

  # Require exactly version 2.70.1 
  version = "= 2.70.1"
}

With this configuration, Terraform will attempt to fetch and install the exact version you have specified:

terraform init 

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/aws versions matching "2.70.1"...
- Finding latest version of hashicorp/null...
- Installing hashicorp/aws v2.70.1...
- Installed hashicorp/aws v2.70.1 (signed by HashiCorp)
- Using previously-installed hashicorp/null v3.1.0

Terraform has made some changes to the provider dependency selections recorded
in the .terraform.lock.hcl file. Review those changes and commit them to your
version control system if they represent changes you intended to make.

Terraform has been successfully initialized!

Note that if you have already installed a different version of the provider, you may receive an error about your provider version being locked:

╷
│ Error: Failed to query available provider packages
│
│ Could not retrieve the list of available versions for provider hashicorp/aws: locked
│ provider registry.terraform.io/hashicorp/aws 2.70.0 does not match configured version
│ constraint 2.70.1; must use terraform init -upgrade to allow selection of new versions
╵

If your receive this error, you can re-run your init command and pass the --upgrade flag to signal to Terraform that it's okay to install a new provider version:

terraform init --upgrade

Which will result in a successful provider version change:

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/aws versions matching "2.70.1"...
- Finding latest version of hashicorp/null...
- Installing hashicorp/aws v2.70.1...
- Installed hashicorp/aws v2.70.1 (signed by HashiCorp)
- Using previously-installed hashicorp/null v3.1.0

Terraform has made some changes to the provider dependency selections recorded
in the .terraform.lock.hcl file. Review those changes and commit them to your
version control system if they represent changes you intended to make.

Terraform has been successfully initialized!