Hack University
← All cheatsheets
Terraform
Providers

Terraform Cheatsheet

Providers

Use this Terraform reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

What Providers Are

Providers are plugins that translate Terraform resource blocks into API calls for a specific platform (AWS, GCP, Azure, GitHub, Kubernetes, etc.). The Terraform Registry hosts thousands of them.

Declaring Providers

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"   # <namespace>/<type>
      version = "~> 6.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

Configuring a Provider

provider "aws" {
  region  = "us-east-1"
  profile = "myprofile"   # ~/.aws/credentials profile
}

Most providers pick up credentials from environment variables automatically:

export AWS_ACCESS_KEY_ID="AKIA..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_DEFAULT_REGION="us-east-1"

Multiple Provider Instances (alias)

Use alias when you need the same provider in different configurations (e.g., two AWS regions).

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

resource "aws_s3_bucket" "backup" {
  provider = aws.west   # reference with <type>.<alias>
  bucket   = "my-west-backup"
}

Common Providers Quick Reference

ProviderSourceAuth env vars
AWShashicorp/awsAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
GCPhashicorp/googleGOOGLE_CREDENTIALS or ADC
Azurehashicorp/azurermARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID
Kuberneteshashicorp/kuberneteskubeconfig or in-cluster
GitHubintegrations/githubGITHUB_TOKEN
DatadogDataDog/datadogDD_API_KEY, DD_APP_KEY
Cloudflarecloudflare/cloudflareCLOUDFLARE_API_TOKEN

AWS Provider — Common Config Options

provider "aws" {
  region              = var.aws_region
  profile             = var.aws_profile
  allowed_account_ids = ["123456789012"]   # safety guard

  default_tags {
    tags = {
      ManagedBy = "terraform"
      Project   = var.project_name
    }
  }

  assume_role {
    role_arn     = "arn:aws:iam::ACCOUNT_ID:role/TerraformRole"
    session_name = "terraform"
  }
}

GCP Provider

provider "google" {
  project = var.gcp_project
  region  = "us-central1"
  zone    = "us-central1-a"
}

# Credentials via file:
provider "google" {
  credentials = file("sa-key.json")
  project     = var.gcp_project
  region      = "us-central1"
}

Azure Provider

provider "azurerm" {
  features {}              # required empty block
  subscription_id = var.subscription_id
  tenant_id       = var.tenant_id
}

Kubernetes Provider

provider "kubernetes" {
  config_path    = "~/.kube/config"
  config_context = "my-cluster"
}

# Or from EKS data source:
provider "kubernetes" {
  host                   = data.aws_eks_cluster.main.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.main.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.main.token
}

Provider-Level Meta-Arguments

resource "aws_instance" "west" {
  provider = aws.west    # use aliased provider
  ami      = "ami-..."
  instance_type = "t3.micro"
}

Locking Provider Versions

terraform init writes .terraform.lock.hcl — commit this file to lock exact versions across the team.

terraform providers lock \
  -platform=linux_amd64 \
  -platform=darwin_arm64    # add hashes for multiple platforms

Useful Provider Commands

terraform providers            # list providers used in current config
terraform providers schema     # dump provider schema as JSON
terraform init -upgrade        # upgrade to latest allowed versions (updates lock file)