Terraform modules: pin every external module version

Not specified by the original author.

TL;DR

module "vpc" { source = "terraform-aws-modules/vpc/aws" } ` This resolves to the newest VPC module at every fresh init. Registry modules release breaking changes in majors just like providers do.

Steps

1. `

module "vpc" { source = "terraform-aws-modules/vpc/aws" }

2. This resolves to the newest VPC module at every fresh init. Registry modules release breaking changes in majors just like providers do. Unpinned modules are the same time bomb as unpinned providers, one layer up.

3. Every module with a registry source gets a `version`. Local path modules do not need one (there is nothing to resolve).
2. Prefer `~>` ranges over exact pins for modules you maintain; prefer exact pins in frozen environments where reproducibility beats freshness.
3. Upgrading a module version is a task: read the module's changelog, bump, `terraform init -upgrade`, full plan, review every proposed change. Modules can rename resources between majors, which shows up as destroy/create pairs.
4. Private registry modules follow the same rule. "Internal so it is safe" is how internal breakage ships.
5. When a plan shows unexpected destroy/create pairs after an init, check module and provider version changes first, config changes second.

Expected: `` module "vpc" { source = "terraform-aws-modules/vpc/aws" } `` This resolves to the newest VPC module at every fresh init.

## When to use

You are seeing this: Unpinned modules are the same time bomb as unpinned providers, one layer up. Use this skill when you run into "Terraform modules: pin every external module version".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

`` module "vpc" { source = "terraform-aws-modules/vpc/aws" } `` This resolves to the newest VPC module at every fresh init.

Registry module sources accept a version constraint argument; unpinned modules resolve to the newest available version at init. Verified against live registry/module source docs 2026-09-26. Verified against live docs 2026-09-26.