Terraform Provider Configuration & Aliases Prompt

You are a senior Terraform engineer who has built deployments using multiple provider configurations — multi-region, multi-account, cross-cloud.

I will provide:
- The deployment scenario
- Current provider config
- Symptom (wrong region resources, account mismatch)

Your job:

1. **Provider basics**:
   - `terraform { required_providers { ... } }` declares
   - `provider "<name>" { ... }` configures
   - Auto-pulled at `terraform init`
2. **For version constraints**:
   - `version = "~> 5.0"` (>=5.0, <6.0)
   - Pin tightly for stability
   - Update intentionally
3. **For aliases (multi-region)**:
   - `provider "aws" { alias = "us-east-1" region = "us-east-1" }`
   - Reference: `provider = aws.us-east-1`
   - Per-resource
4. **For multi-account**:
   - Per-account provider with `assume_role`
   - Different alias per account
5. **For module + alias**:
   - Module declares `providers` map
   - Caller passes specific provider
   - `providers = { aws = aws.us-west-2 }`
6. **For provider auth**:
   - Env vars (AWS_ACCESS_KEY_ID, etc.)
   - Shared credentials file
   - IAM instance role
   - assume_role for cross-account
7. **For default_tags** (AWS):
   - Tags applied to all resources
   - Common pattern for ManagedBy=Terraform
8. **For provider features**:
   - AWS: `skip_metadata_api_check`
   - Different defaults per provider

Mark DESTRUCTIVE: mixing provider versions across modules (drift), removing alias mid-deploy (resources orphan), credentials in committed files.

---

Scenario: [DESCRIBE]
Current config: [PASTE]
Symptom: [DESCRIBE]

Why this prompt works

Provider config is the foundation. This prompt walks patterns.

How to use it

1. Pin versions tightly.
2. Alias for multi-region/account.
3. default_tags for governance.
4. No creds in code.

Patterns

Required providers

# versions.tf
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.30"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }
}

Default + aliased providers

# providers.tf
provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "Terraform"
      Repository  = "github.com/myorg/infra"
    }
  }
}

provider "aws" {
  alias  = "us-west-2"
  region = "us-west-2"

  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "Terraform"
    }
  }
}

provider "aws" {
  alias  = "dr"
  region = "eu-west-1"

  default_tags {
    tags = {
      Environment = var.environment
      Purpose     = "disaster-recovery"
    }
  }
}

Using aliases per-resource

# Primary region
resource "aws_s3_bucket" "primary" {
  bucket = "myorg-data-primary"
}

# Replication in another region (alias provider)
resource "aws_s3_bucket" "replica" {
  provider = aws.dr
  bucket   = "myorg-data-replica"
}

Multi-account with assume_role

provider "aws" {
  alias  = "audit_account"
  region = "us-east-1"

  assume_role {
    role_arn     = "arn:aws:iam::AUDIT_ACCOUNT_ID:role/TerraformReadOnly"
    session_name = "TerraformAudit"
    external_id  = "myorg-tf"
  }
}

# Read audit account resources
data "aws_caller_identity" "audit" {
  provider = aws.audit_account
}

Module with multiple providers

# modules/replicated-bucket/main.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
      configuration_aliases = [aws.primary, aws.replica]
    }
  }
}

resource "aws_s3_bucket" "primary" {
  provider = aws.primary
  bucket   = "${var.name}-primary"
}

resource "aws_s3_bucket" "replica" {
  provider = aws.replica
  bucket   = "${var.name}-replica"
}

# Root: caller passes providers
module "replicated_data" {
  source = "./modules/replicated-bucket"

  providers = {
    aws.primary = aws            # default
    aws.replica = aws.us-west-2
  }

  name = "important-data"
}

Cross-cloud (AWS + GCP)

provider "aws" {
  region = "us-east-1"
}

provider "google" {
  project = "myorg-prod"
  region  = "us-central1"
}

# Both at once
resource "aws_s3_bucket" "logs" { bucket = "myorg-logs-aws" }
resource "google_storage_bucket" "logs" {
  name     = "myorg-logs-gcp"
  location = "US"
}

Common findings this catches

• Version unpinned → tighten constraint.
• Resource in wrong region → check provider alias.
• Credentials in tf → external (env, IAM, SSO).
• default_tags missing → governance gap.
• Module forgot configuration_aliases → required to use aliases.
• assume_role without external_id → confused deputy.
• Multi-account audit issues → CloudTrail across.

When to escalate

• Cross-account access design — security.
• Provider upgrade across many modules — staged.
• Auth strategy (SSO vs static) — coordinate.