Terraform 1.16

Use these standalone rules for Terraform 1.16 configuration, modules, providers, state, plans, credentials, lifecycle, policy, and deployment. Treat source, modules, providers, runner identity, plans, state, and target control planes as distinct trust boundaries.

Required versions

• Set required_version to a tested constraint that still admits later minors, such as ~> 1.16, because Terraform puts fixes on its newest minor and an older minor rarely gets another patch once the next one ships.
• Declare every provider source address and a narrow tested version constraint.
• Commit .terraform.lock.hcl and review provider hashes, but pin remote modules separately because the lock file records providers only, not module selections.
• Use immutable Terraform, provider, and module artifacts in automated deployment.
• Test each Terraform, provider, and module upgrade in isolated state before it reaches production, including a newer minor that the version constraint already admits.
• Run the newest Terraform release in every job, taking its exact version from the Terraform releases page or leaving a placeholder that fails the job rather than a version you remember. Let Renovate or Dependabot propose provider and module updates and .terraform.lock.hcl refreshes, and reference runner images by a digest the bot maintains. The 1.16 in this prompt's title names the series these rules were checked against, not a release to install.

Providers

• Configure provider regions, projects, subscriptions, endpoints, aliases, and security behavior from trusted deployment input.