HashiCorp Terraform Associate (004) Question 140
Single answer5a Explain how Terraform sources modulesA platform team maintains a reusable VPC module in a Git repository. For production stability, application teams must consume a specific tagged version of that module and avoid unexpected changes when new commits are pushed. One team writes the following module block:
module "network" { source = "git::https://example.com/network-modules.git//aws/vpc?ref=v1.4.2" }
After running terraform init, Terraform successfully downloads the module. What does this configuration tell Terraform to do?
- A
Download the module from the Git repository, use the
aws/vpcsubdirectory, and check out the Git tagv1.4.2. - B
Download only the
aws/vpcfolder directly over HTTPS and ignore the rest of the Git repository contents. - C
Install the module from the public Terraform Registry because the source includes a version-like value in
ref. - D
Clone the Git repository's default branch and use
v1.4.2as the Terraform module version constraint.
Show answer and explanation
Correct answer: A
Explanation
Terraform can source modules from several locations, including local paths, the Terraform Registry, Git repositories, generic HTTP URLs, and other package locations supported by Terraform. In this scenario, the source string uses the VCS syntax for Git: git::https://.... The double slash //aws/vpc identifies a subdirectory within the repository, which is useful when one repository stores multiple modules. The ref query parameter pins the module to a specific Git ref, such as a tag, branch, or commit SHA, helping teams avoid unplanned changes. This differs from Terraform Registry modules, where the source address uses registry naming and the module version is set with a separate version argument. HashiCorp documentation on module sources and module block syntax covers these patterns and their intended usage.
- A. Correct.
Correct. The
git::prefix tells Terraform to use a Git source. The//aws/vpcportion selects a subdirectory within the repository as the module source, and?ref=v1.4.2instructs Terraform to check out a specific Git reference such as a tag, branch, or commit. This is a common way to pin a reusable module to a known version for predictable builds. - B. Incorrect.
Incorrect. Terraform does not fetch only that folder as a standalone HTTP download in this syntax. With a Git source, Terraform uses the repository as the source and then points the module to the specified subdirectory inside the downloaded repository. A common misconception is to treat
//subdiras a direct web path rather than a path within the VCS source. - C. Incorrect.
Incorrect. Terraform Registry module sources use a different source address format, such as
hashicorp/consul/aws, and versioning is handled with theversionargument for registry modules. In this example,refis part of a Git source query string, not a registry version selection mechanism. - D. Incorrect.
Incorrect.
ref=v1.4.2does not act like theversionargument used with registry modules. Instead, it selects a specific Git reference. If that ref points to a tag, Terraform uses that tag rather than the default branch. The option mixes two different module sourcing mechanisms: VCS refs and registry version constraints.