Docs

Terraform Lock

sourceconditiontarget

✗

✔

✔

Description

The terraform/lock resource maintains a .terraform.lock.hcl dependency lock file: for a given provider it updates the version, the version constraint, and the package checksums - without running terraform init. The checksums are fetched from the registry for the platforms you list.

condition

Tests that the lock file already records that version and its hashes for the provider.

target

Rewrites the provider’s version, constraints and hashes entries.

source

Not supported - a source fails with Source not supported for the plugin terraform/lock. Pair this resource with terraform/registry, which supplies the version.

Parameters

NameTypeDescriptionRequired
filestring

“file” defines the terraform lock file path to interact with.

compatible: * condition * target

remark: * “file” and “files” are mutually exclusive * protocols “https://”, “http://”, and “file://” are supported in path for condition

filesarray

“files” defines the list of terraform lock files path to interact with.

compatible: * condition * target

remark: * file and files are mutually exclusive * when using as a condition only one file is supported * protocols “https://”, “http://”, and “file://” are supported in file path for condition

platformsarray

“platforms” is the target platforms to request package checksums for.

compatible: * condition * target

providerstring

“provider” is the terraform provider you wish to update, supports with or without registry url.

compatible: * condition * target

skipconstraintsboolean

“skipconstraints” will control whether the constraint in lock file is updated

compatible: * condition * target

NOTE: That turning this off can break the lockfile if version value source does not follow the constraints

valuestring

“value” is the value associated with a terraform provider.

compatible: * condition * target

default: When used from a condition or a target, the default value is set to linked source output.

file or files, provider and platforms are all mandatory - missing any of them aborts the run with wrong spec content, preceded by terraform/lock file undefined, terraform/lock provider undefined or terraform/lock platforms undefined. file and files are mutually exclusive, and a condition accepts only one file.

provider

Accepts the short form or the fully qualified one (hashicorp/kubernetes and registry.terraform.io/hashicorp/kubernetes both work).

platforms

The platforms to request checksums for, such as linux_amd64 or darwin_arm64. Only the platforms listed here end up in the lock file, exactly as with terraform providers lock -platform=…​. Omitting the platform your CI runs on will make terraform init fail there.

Warning

skipconstraints: true updates the version and the hashes but leaves the constraints line alone. That produces a lock file Terraform rejects whenever the new version falls outside the existing constraint. Leave it unset unless the constraint is managed elsewhere (for example by a terraform/provider target in the same pipeline).

Remote files

For a condition, file accepts https://, http:// and file://. A target must write locally and refuses a URL.

Example

The example uses an additional resource plugin: terraform/registry.

# updatecli.yaml
name: Terraform Lock

sources:
  kubernetes:
    name: Get version from registry
    kind: terraform/registry
    spec:
      type: provider
      namespace: hashicorp
      name: kubernetes

conditions:
  using-value:
    name: Condition using value
    kind: terraform/lock
    disablesourceinput: true
    spec:
      file: .terraform.lock.hcl
      provider: hashicorp/kubernetes
      platforms:
        - linux_amd64
      value: 2.22.0

  https:
    name: Condition using HTTP
    kind: terraform/lock
    disablesourceinput: true
    spec:
      file: https://raw.githubusercontent.com/updatecli-test/jenkins-infra-aws/main/.terraform.lock.hcl
      provider: hashicorp/kubernetes
      platforms:
        - linux_amd64
      value: 2.22.0


targets:
  update-file-from-source:
    name: Update files content from value
    kind: terraform/lock
    sourceid: kubernetes
    spec:
      file: .terraform.lock.hcl
      provider: hashicorp/kubernetes
      platforms:
        - linux_amd64

Links

Last updated on July 30, 2026
Prev
Terraform File
Next
Terraform Provider