Open DanielMSchmidt opened 1 year ago
I like this from a versioning perspective, but I worry about it from a security perspective. .terraform.lock.hcl
functions as both version pinning and checksum matching.
can the alternative approach be considered?
TF_PLUGIN_CACHE_DIR
thay way terraform will always use the same provider binary as long as the same e.g. python package is used, w/o the need to touch .terraform.lock.hcl
what's your opinion?
Community Note
Description
CDKTF bindings pin provider versions in general, therefore we could generate the
.terraform.lock.hcl
file for each stack as part of our synthetization. This makes using the provider across different machines / architectures easier and improves our upgrade workflow to have one less step, see #2020. This means we trim the sources of provider versions down to just the provider bindings instead of e.g. the last run of terraform init as well.References