Hack University
← All cheatsheets
Terraform
Providers

Terraform Cheatsheet

Providers

Use this Terraform reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

What Providers Are

Providers are plugins that translate Terraform resource blocks into API calls for a specific platform (AWS, GCP, Azure, GitHub, Kubernetes, etc.). The Terraform Registry hosts thousands of them.

Declaring Providers

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"   # <namespace>/<type>
      version = "~> 6.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

Configuring a Provider

provider "aws" {
  region  = "us-east-1"
  profile = "myprofile"   # ~/.aws/credentials profile
}

Most providers pick up credentials from environment variables automatically:

export AWS_ACCESS_KEY_ID="AKIA..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_DEFAULT_REGION="us-east-1"

Multiple Provider Instances (alias)

Use alias when you need the same provider in different configurations (e.g., two AWS regions).

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

resource "aws_s3_bucket" "backup" {
  provider = aws.west   # reference with <type>.<alias>
  bucket   = "my-west-backup"
}

Common Providers Quick Reference

ProviderSourceAuth env vars
AWShashicorp/awsAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
GCPhashicorp/googleGOOGLE_CREDENTIALS or ADC
Azurehashicorp/azurermARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID
Kuberneteshashicorp/kuberneteskubeconfig or in-cluster
GitHubintegrations/githubGITHUB_TOKEN
DatadogDataDog/datadogDD_API_KEY, DD_APP_KEY
Cloudflarecloudflare/cloudflareCLOUDFLARE_API_TOKEN

AWS Provider — Common Config Options

provider "aws" {
  region              = var.aws_region
  profile             = var.aws_profile
  allowed_account_ids = ["123456789012"]   # safety guard

  default_tags {
    tags = {
      ManagedBy = "terraform"
      Project   = var.project_name
    }
  }

  assume_role {
    role_arn     = "arn:aws:iam::ACCOUNT_ID:role/TerraformRole"
    session_name = "terraform"
  }
}

GCP Provider

provider "google" {
  project = var.gcp_project
  region  = "us-central1"
  zone    = "us-central1-a"
}

# Credentials via file:
provider "google" {
  credentials = file("sa-key.json")
  project     = var.gcp_project
  region      = "us-central1"
}

Azure Provider

provider "azurerm" {
  features {}              # required empty block
  subscription_id = var.subscription_id
  tenant_id       = var.tenant_id
}

Kubernetes Provider

provider "kubernetes" {
  config_path    = "~/.kube/config"
  config_context = "my-cluster"
}

# Or from EKS data source:
provider "kubernetes" {
  host                   = data.aws_eks_cluster.main.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.main.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.main.token
}

Provider-Level Meta-Arguments

resource "aws_instance" "west" {
  provider = aws.west    # use aliased provider
  ami      = "ami-..."
  instance_type = "t3.micro"
}

Locking Provider Versions

terraform init writes .terraform.lock.hcl — commit this file to lock exact versions across the team.

terraform providers lock \
  -platform=linux_amd64 \
  -platform=darwin_arm64    # add hashes for multiple platforms

Useful Provider Commands

terraform providers            # list providers used in current config
terraform providers schema     # dump provider schema as JSON
terraform init -upgrade        # upgrade to latest allowed versions (updates lock file)