terraform

No entries match these filters. Clear filters

1. v1.17.0 Oct 21, 2026 · issue 116

   Terraform v1.17 ships GA Policy enforcement, a new -minimal-refresh flag, and variables/locals in provider requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.17.0 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.17.0

   └──▷ TRY IT
   Speed up CI plan runs by only refreshing the resources that are actually changing, skipping unchanged remote state reads.
   copy

   $ terraform plan -minimal-refresh -out=tfplan

   Enforce org-wide policies in a standard (non-experimental) pipeline by running plan with the now-GA -policies flag.
   copy

   $ terraform apply -policies ./policies/ -auto-approve

   • Adds -minimal-refresh planning flag to plan and apply, refreshing only resources that have proposed changes rather than the full state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Promotes -policies flag on plan, apply, and query to GA — no longer requires an experimental build or -allow-experimental-features; query policies evaluate resources found by list blocks and return human-readable or JSON results.
   • Supports variables and locals in provider required_providers blocks, enabling dynamic provider version and source constraints.
   • Adds mock_provider support for ephemeral resources in terraform test.
   • Adds a format_version field to the JSON output of terraform version, enabling safer future evolution of that output format.
   • Adds -minimal-refresh planning flag to plan and apply, refreshing only resources that have proposed changes rather than the full state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports variables and locals in provider required_providers blocks, enabling dynamic provider version and source constraints.

   3 more in Everything

2. v1.16.0 Aug 26, 2026 · issue 058

   Terraform v1.16 adds store blocks in terraform_data, -json for state/workspace, -format=mermaid for graphs, and module-level import blocks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.16.0 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.16.0

   └──▷ TRY IT
   Get machine-readable JSON output of a resource's state for scripting or audit pipelines.
   copy

   $ terraform state show -json aws_instance.web

   Visualize the Terraform dependency graph in Mermaid format for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. in docs or wikis.
   copy

   $ terraform graph -format=mermaid > graph.md

   Prevent a critical resource from accidental destruction by setting destroy = false in its lifecycle block.
   main.tf copy

   resource "aws_s3_bucket" "critical" {
     bucket = "my-critical-bucket"
   
     lifecycle {
       destroy = false
     }
   }

   • Adds -json flag to terraform state show for machine-readable output.
   • Adds -json flag to terraform workspace list for machine-readable output.
   • Adds -format=mermaid flag to terraform graph to output dependency graphs in Mermaid format.
   • Adds -scope=<module address> flag to terraform console to evaluate expressions within a specific module or module instance scope.
   • Adds store block to the terraform_data resource to hold ephemeral and sensitive values across plan and apply.

   +13 more show less

   • Adds destroy = false to resource lifecycle blocks to prevent a resource from ever being destroyed.
   • Adds on_failure modes halt, taint, and continue to resource action triggers.
   • Adds before_destroy and after_destroy event support to Actions.
   • Adds caller symbol in Action configurations, exposing the object value of the calling resource.
   • Allows -invoke to be combined with -target to specify the calling resource instance when multiple resources trigger the same action.
   • Supports import blocks inside modules.
   • Terraform now stores planned private data for providers, preserving provider-specific state across plan and apply.
   • Providers can now use nested blocks as computed values.
   • The terraform stacks command now automatically infers the target hostname from credentials.tfrc.json when neither TF_STACKS_HOSTNAME nor TF_CLOUD_HOSTNAME is set.
   • Terraform now displays a summary of policy evaluation outcomes for plan and apply runs against HCP Terraform.
   • The contains() function can now test for null values.
   • Terraform is now available as a pre-built binary for Linux s390x (zLinux).
   • Terraform now reports which resources were left behind when skip_cleanup is set in tests.

   18 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !bastion_host_key is now correctly applied by provisioners — review your provisioner configurations to verify the configured key is correct before upgrading.
3. v1.15.5 May 27, 2026 · release notes

   Terraform v1.15.5 adds support for null module version in dynamic module sources.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.5 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.15.5

   • Supports module version evaluating to null in dynamic module source configurations.

   1 detail in Everything

4. v1.15.4 May 20, 2026 · release notes

   Terraform v1.15.4 adds official Linux s390x (zLinux) builds.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.4 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.15.4

5. v1.15.2 May 6, 2026 · release notes

   Terraform v1.15.2 adds output values to plan component instance change descriptions in stacks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.2 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.15.2

6. v1.15.0 Apr 29, 2026 · release notes

   Terraform v1.15 adds a convert function, deprecated variable/output warnings, backend block validation, and variables in module sources.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.0 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.15.0

   └──▷ USE IT
   Mark a variable as deprecated so callers get a warning when they set it — useful when refactoring module interfaces.
   hcl copy

   variable "legacy_region" {
     type       = string
     deprecated = "Use the `region` variable instead; this variable will be removed in v2."
   }

   Use the new convert function to enforce an exact type inline rather than relying on implicit coercion.
   hcl copy

   locals {
     port = convert(var.port_input, number)
   }

   Reference a local or variable in a module source so the registry path or version can be computed dynamically.
   hcl copy

   locals {
     tf_module_version = "2.3.0"
   }
   
   module "vpc" {
     source  = "terraform-aws-modules/vpc/aws"
     version = local.tf_module_version
   }

   • Adds native Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. builds for Terraform.
   • New deprecated attribute on variable and output blocks emits warnings when deprecated variables are passed or deprecated outputs are referenced.
   • S3 backend now supports authentication via aws login (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Identity Center flows).
   • The validate command now checks the backend block — verifying the backend type exists, required attributes are present, and backend-level validation passes.
   • New convert function enables precise inline type conversions in configuration expressions.

   +9 more show less

   • Supports variables and locals in module source and version attributes, and most commands now accept variable values to satisfy them.
   • Output blocks now support explicit type constraints.
   • SSH-based provisioners (file and remote-exec) re-enable PowerShell support.
   • terraform init now skips installing dependencies declared in development overrides, allowing mixed-override workflows.
   • Terraform Test mock blocks now allow function calls.
   • Provider-set deprecation messages on resources, blocks, and attributes are now included in deprecation warnings.
   • Sensitive attribute paths are now included in list_start JSON log entries.
   • Input variable validation is now supported for Stacks.
   • terraform fmt now formats .tfquery.hcl files.

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !backend/s3: AWS_USE_FIPS_ENDPOINT and AWS_USE_DUALSTACK_ENDPOINT environment variables now only accept true or false; any other non-empty value (previously treated as true) is no longer honoured.
7. v1.14.2 Dec 11, 2025 · release notes

   Terraform Stacks gains component registry source resolution support in v1.14.2.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.2 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.14.2

8. v1.14.0 Nov 19, 2025 · release notes

   Terraform 1.14 adds terraform query for live infrastructure querying, top-level Actions blocks, and a new GenerateResourceConfiguration RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. for providers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.0 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.14.0

   └──▷ TRY IT
   Validate query files offline in CI before running against real infrastructure.
   copy

   $ terraform validate -query

   • New list resource type defined in *.tfquery.hcl files enables querying and filtering existing infrastructure.
   • New terraform query command executes list operations against live infrastructure and can optionally generate import configuration.
   • New top-level action block lets providers define imperative, non-CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations (e.g. aws_lambda_invoke) triggered via resource lifecycle or the -invoke CLI flag.
   • New GenerateResourceConfiguration RPC allows providers to produce more precise configuration values during import.
   • Offline validation of query files now supported via -query flag in terraform validate.

   +4 more show less

   • terraform test verbose mode now includes expected diagnostics in test output.
   • terraform test cleanup now ignores the prevent_destroy attribute, unblocking teardown.
   • terraform stacks command now supports the -help flag.
   • Adds support for the AWS European Sovereign Cloud.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Building Terraform 1.14 requires macOS Monterey or later (Go 1.25 requirement); earlier macOS versions are no longer supported for building.
   • !Parallelism of Terraform operations within container runtimes may be reduced depending on the CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. bandwidth limit setting.
9. v1.13.0 Aug 20, 2025 · release notes

   Terraform v1.13.0 adds terraform stacks CLI, richer terraform test variable authoring, and parallel teardown for tests.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.13.0 https://github.com/hashicorp/terraform.git
   # already have the repo? check out this version:
   $ git checkout v1.13.0

   └──▷ TRY IT
   Discover all available stack sub-commands after upgrading to v1.13.
   copy

   $ terraform stacks -usage

   Define an external variable inline in a test file so complex variable types are validated without a separate tfvars source.
   hcl copy

   # inside mymodule.tftest.hcl
   variable "region" {
     default = "us-east-1"
   }
   
   run "deploy" {
     variables {
       region = var.region
     }
   }

   • New terraform stacks command exposes stack operations through the CLI; run terraform stacks -usage to see available sub-commands.
   • Filesystem functions are now validated for consistent results during apply, catching invalid data earlier.
   • terraform test: Test authors can define external variable blocks directly inside test files, removing the need for external variable sources.
   • terraform test: File-level variable blocks can now reference run outputs and other variables, enabling richer test composition.
   • terraform test: Teardown operations can now run in parallel, reducing test suite cleanup time.

   +2 more show less

   • Improved type-mismatch error messages make diagnosing configuration type errors faster.
   • The terraform rpcapi command is now generally available, exposing Terraform operations over a go-plugin-compatible RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. interface.

   7 details in Everything

10. v1.12.0 May 14, 2025 · release notes

    Terraform v1.12 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Object Storage backend, parallel test runs, and identity-based resource imports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.12.0

    └──▷ TRY IT
    Speed up a large Terraform test suite by running plan/apply operations in parallel across test runs.
    copy

    $ terraform test -parallelism=4

    Import an existing cloud resource using a structured identity attribute instead of a flat string ID.
    hcl copy

    # In your Terraform config:
    import {
      identity = {
        project = "my-project"
        region  = "us-east1"
        name    = "my-resource"
      }
      to = google_some_resource.example
    }

    • Adds new backend for OCI Object Storage, enabling remote state storage on Oracle Cloud Infrastructure.
    • New -parallelism=n flag for terraform test sets the number of parallel operations during plan/apply in a test run.
    • Test runs can now be annotated for possible parallel execution, speeding up large test suites.
    • Logical binary operators (&&, ||) now short-circuit, avoiding unnecessary evaluation of the right-hand side.
    • import blocks now support a new identity attribute as an alternative to id for identifying resources to import.

    +5 more show less

    • OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. backend supports additional standard environment variables, aligning with provider settings.
    • terraform init now works when test files are present but no .tf configuration files exist in the current directory.
    • Terraform Test continues subsequent test execution when an expected failure is not encountered.
    • Detailed diagnostic objects are now produced when test run assertions fail.
    • Elapsed time in the UI Hook now displays in mm:ss format for clearer progress reporting.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !On Linux, Terraform now requires Linux kernel version 3.2 or later; systems running older kernels will not be supported.
11. v1.11.2 Mar 12, 2025 · release notes

    Azure backend gains ADO Pipelines OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. token refresh support via new ado_pipeline_service_connection_id setting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.2 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.11.2

    └──▷ USE IT
    Authenticate Terraform's Azure backend with an Azure DevOps Pipeline OIDC token that auto-refreshes during long runs.
    hcl copy

    terraform {
      backend "azurerm" {
        resource_group_name  = "tfstate-rg"
        storage_account_name = "tfstateacct"
        container_name       = "tfstate"
        key                  = "prod.terraform.tfstate"
        oidc_request_url     = "$SYSTEM_OIDCREQUESTURI"
        oidc_request_token   = "$SYSTEM_ACCESSTOKEN"
        ado_pipeline_service_connection_id = "<service-connection-id>"
      }
    }

12. v1.11.0 Feb 27, 2025 · release notes

    Terraform v1.11 adds write-only resource attributes, GA S3 native state locking, and JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. test reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    └──▷ TRY IT
    Run tests in CI and emit a JUnit XML report that can be ingested by test reporting tools like Jenkins or GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure..
    copy

    $ terraform test -junit-xml=results.xml

    Enable S3-native state locking without DynamoDB by setting use_lockfile in your S3 backend config.
    hcl copy

    terraform {
      backend "s3" {
        bucket      = "my-tf-state"
        key         = "prod/terraform.tfstate"
        region      = "us-east-1"
        use_lockfile = true
      }
    }

    • Adds write-only resource attributes: providers can mark attributes as write-only so they are never persisted in state, enabling safe use of ephemeral values in those fields.
    • Promotes terraform test -junit-xml to general availability, producing structured JUnit XML test reports.
    • Promotes S3 native state locking to GA via the use_lockfile argument in the S3 backend, eliminating the need for a DynamoDB table.
    • Adds override_during = plan option in terraform test run blocks so mocked/overridden values are applied during the plan phase instead of only at apply.
    • Adds state_key attribute to run blocks in terraform test, giving test authors control over which internal state file a test run uses.

    +3 more show less

    • Expands Azure backend authentication with new properties: use_cli, use_aks_workload_identity, client_id_file_path, client_certificate, and client_secret_file_path, aligning with azurerm provider auth.
    • Supports .netrc credentials during terraform init provider installation for registry download and shasum URLs.
    • Includes the ca-certificates package in the official Terraform Docker image for improved certificate handling.

    8 details in Everything

13. v1.10.0 Nov 27, 2024 · release notes

    Terraform v1.10 adds ephemeral resources and values, S3 native state locking, and new Tencent Cloud backend auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    └──▷ USE IT
    Pass an ephemeral variable (e.g. a bootstrap password) into your config so it is never recorded in the plan or state file.
    hcl copy

    variable "admin_password" {
      type      = string
      ephemeral = true
      sensitive = true
    }

    Strip ephemeral marks from a value so it can be safely passed to a resource attribute that does not accept ephemeral inputs.
    hcl copy

    locals {
      safe_password = ephemeralasnull(var.admin_password)
    }

    • Adds ephemeral resources: a new resource kind re-read on every evaluation phase whose values are never written to state or plan files.
    • Adds ephemeral input variables and outputs: mark variables or outputs as ephemeral = true to prevent them from being persisted to plan or state.
    • Adds ephemeralasnull function: converts any ephemeral values in a structure to non-ephemeral nulls, enabling safe use of ephemeral data where persistence is required.
    • S3 backend now supports S3 native state locking alongside existing DynamoDB-based locking.
    • Adds new authentication method for the Tencent Cloud (cos) backend.

    +2 more show less

    • The element function now accepts negative indices for reverse list access.
    • Improves import block validation to catch more invalid cases during terraform validate.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !backend/s3: Deprecated top-level IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role assumption attributes are removed; you must now use the assume_role block instead.
    • !moved blocks now reserve keywords when parsing resource addresses; configurations referencing resources whose type names match top-level block keywords must prepend resource. to those references.
    • !HCL conditional expressions now combine marks from all values in the expression, which may cause previously-lost sensitive marks to surface, making some values sensitive where they were not before.
14. v1.9.5 Aug 20, 2024 · release notes

    Terraform v1.9.5 adds HCP resource ID support for cloud workspaces.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.5 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.9.5

    • Supports interacting with HCP-resource-ID-backed workspaces via the cloud block.

    1 detail in Everything

15. v1.9.0 Jun 26, 2024 · release notes

    Terraform v1.9.0 adds -json to init, general expression validation rules for input variables, and the templatestring function

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    └──▷ TRY IT
    Get machine-readable JSON output from initialization to parse in CI/CD scripts.
    copy

    $ terraform init -json

    Render a template dynamically passed from a data resource or other variable, avoiding file system dependency.
    text copy

    # In variables.tf
    variable "template_content" {
      type = string
    }
    
    # In resources.tf
    resource "example_resource" "foo" {
      config = templatestring(var.template_content, { key = var.value })
    }

    Write validation rules that reference other variables or data sources within the same module.
    text copy

    # In variables.tf
    variable "allowed_regions" {
      type = list(string)
    }
    
    variable "region" {
      type = string
      
      validation {
        # Can now refer to `var.allowed_regions` directly
        condition     = contains(var.allowed_regions, var.region)
        error_message = "Region must be in the allowed list."
      }
    }

    • terraform init now accepts the -json flag for machine-readable output.
    • Input variable validation rules are now general expressions that can refer to other input variables and data resources.
    • New built-in templatestring function allows rendering templates provided as strings rather than file paths.
    • terraform test can now pass sensitive values to input variables while preserving their dynamic sensitivity during test runs.
    • removed blocks can now declare destroy-time provisioners that execute when associated resource instances are destroyed.

    +1 more show less

    • Performance improvements for graph building in configurations with an extremely large number of resource blocks.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !import blocks pointing to nonexistent modules are no longer silently ignored and will raise an error.
16. v1.8.0 Apr 10, 2024 · release notes

    Terraform v1.8 introduces provider functions, cross-type resource moves, the issensitive() function, and new plan JSON flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • terraform providers lock now accepts -enable-plugin-cache to leverage a configured global plugin cache during locking
    • Added issensitive() function to check if a value is marked as sensitive in configuration language
    • Built-in terraform provider gains decode_tfvars, encode_tfvars, and encode_expr functions
    • terraform show JSON rendering now includes explicit applyable and complete flags for plan characteristics
    • moved blocks now support transferring ownership of remote objects between resources of different types if the target provider declares conversion capability

    5 details in Everything

17. v1.7.2 Jan 31, 2024 · release notes

    terraform fmt now includes .tfmock.hcl files in formatting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.2 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.7.2

    • terraform fmt now formats Terraform mock data files (.tfmock.hcl).
    • Add diagnostics when a generated provider block fails schema validation.

    2 details in Everything

18. v1.7.0 Jan 17, 2024 · release notes

    Terraform v1.7.0 adds terraform test mocking, removed block for refactoring, and console plan evaluation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    └──▷ TRY IT
    Evaluate expressions against the planned state during an interactive console session
    copy

    $ terraform console -plan
    > plan.resources[0].attributes.id

    • terraform test: Add mock_provider, override_resource, override_data, and override_module blocks to .tftest.hcl files for provider and resource mocking
    • Add removed block to configuration for refactoring module references without manually running terraform state rm
    • terraform console: Add -plan option to evaluate expressions against the planned new state
    • import block: Support for_each to expand imports for multiple resource instances
    • backend/s3: use_legacy_workflow argument defaults to false and uses AWS SDK default provider chain

    +1 more show less

    • terraform graph: Default output is now a simplified resources-only graph

    6 details in Everything

19. v1.6.4 Nov 15, 2023 · release notes

    Adds endpoints.sso and proxy parameters to the S3 backend configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.4 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.6.4

    • Adds endpoints.sso config key in the S3 backend to override the AWS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. API endpoint.
    • Adds https_proxy and no_proxy config keys to the S3 backend for explicit proxy configuration.

    2 details in Everything

20. v1.6.3 Nov 1, 2023 · release notes

    Terraform v1.6.3 adds skip_s3_checksum to S3 backend for compatibility with non-standard S3 APIs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.3 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.6.3

21. v1.6.1 Oct 10, 2023 · release notes

    Adds skip_requesting_account_id argument for non-standard AWS S3 backends

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

    • Adds skip_requesting_account_id to the backend "s3" block to support AWS API implementations without IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., or metadata API

    1 detail in Everything

22. v1.6.0 Oct 4, 2023 · release notes

    Terraform v1.6 adds generally available terraform test command and allows saving Terraform Cloud remote plans locally.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ TRY IT
    Validate Terraform configuration by running assertions against the plan and state during CI/CD or local development
    copy

    $ terraform test *.tftest.hcl

    Save a remote plan from Terraform Cloud to disk so it can be inspected locally before applying in a different environment or workflow
    copy

    $ terraform plan -out=remote_plan.tfplan -var-file=prod.tfvars

    • terraform test subcommand is now generally available for executing .tftest.hcl files with run blocks to validate configurations via plan/apply assertions
    • New -out flag on terraform plan enables saving Remote Plans from Terraform Cloud/Enterprise as local .plan files for later viewing and application
    • config: The import block now accepts dynamic expressions for its id field, such as resource attributes, provided the value is known at plan time
    • core: Provider schemas are now cached globally for compatible providers, reducing memory usage across multiple instances of the same provider
    • core: The type system now tracks unknown value details (e.g., collection length ranges, nullability) enabling more precise results for try and can functions with unknown arguments

    +13 more show less

    • backend/kubernetes: Kubernetes backend can now store states larger than 1MiB by splitting state across multiple secrets
    • terraform show -json: The JSON output now includes an errored property to indicate if a planning process halted with an error, making the plan non-applicable
    • backend/s3: New nested assume_role and endpoints blocks for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role and endpoint configuration, deprecating top-level flat arguments
    • backend/s3: The S3 backend now supports custom HTTP proxy configurations via new http_proxy, insecure, use_fips_endpoint, and use_dualstack_endpoint arguments alongside their environment variable counterparts
    • backend/s3: New assume_role_with_web_identity nested block allows assuming roles using dynamic credentials like Web Identity Tokens
    • backend/s3: Added support for standard AWS environment variables AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE for credential resolution
    • backend/s3: New arguments shared_config_files and shared_credentials_files allow specifying custom credential/configuration file paths directly in the backend config
    • backend/s3: The S3 backend now supports custom_ca_bundle argument and AWS_CA_BUNDLE environment variable for providing custom CA certificates
    • backend/s3: New arguments ec2_metadata_service_endpoint and ec2_metadata_service_endpoint_mode along with corresponding environment variables allow configuring the EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. metadata service (IMDS) endpoint
    • backend/s3: Added sts_region argument to specify an alternative AWS region for STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. operations
    • backend/s3: New retry_mode argument and AWS_RETRY_MODE environment variable allow configuring the retry strategy for S3 backend requests
    • backend/s3: Added allowed_account_ids and forbidden_account_ids arguments to prevent unintended modifications to specific AWS accounts via the backend
    • backend/cos: Cloud Object Storage backend now supports custom HTTP(S) endpoints and root domains for its API client

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !macOS support dropped for versions earlier than macOS 10.15 Catalina
    • !Windows support dropped for versions earlier than Windows 10 or Windows Server 2016
    • !Top-level S3 backend arguments role_arn, session_name, external_id, assume_role_duration_seconds, assume_role_policy_arns, assume_role_tags, and assume_role_transitive_tag_keys are deprecated in favor of the nested assume_role block
    • !Top-level S3 backend arguments dynamodb_endpoint, iam_endpoint, endpoint, and sts_endpoint are deprecated in favor of the nested endpoints block
    • !Old S3 environment variable names AWS_DYNAMODB_ENDPOINT, AWS_IAM_ENDPOINT, AWS_S3_ENDPOINT, and AWS_STS_ENDPOINT are deprecated in favor of AWS_ENDPOINT_URL_DYNAMODB, AWS_ENDPOINT_URL_IAM, AWS_ENDPOINT_URL_S3, and AWS_ENDPOINT_URL_STS
    • !S3 backend argument shared_credentials_file is deprecated in favor of shared_credentials_files
    • !S3 backend argument force_path_style is deprecated in favor of use_path_style
23. v1.5.0 Jun 12, 2023 · release notes

    Terraform v1.5 introduces configuration-driven check/import blocks and a -generate-config-out flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • Adds check blocks for validating infrastructure with scoped data sources
    • Adds import blocks to declare intent for adopting existing resources in the root module
    • Adds -generate-config-out=PATH flag to terraform plan to generate HCL for imported resources
    • Adds a new plantimestamp() function that returns the timestamp at plan time
    • Adds a new strcontains() function that checks whether a given string contains a given substring

    +1 more show less

    • Adds support for PG_CONN_STR, PG_SCHEMA_NAME, PG_SKIP_SCHEMA_CREATION, PG_SKIP_TABLE_CREATION and PG_SKIP_INDEX_CREATION environment variables in the pg backend

    6 details in Everything

24. v1.4.0 Mar 8, 2023 · release notes

    Terraform v1.4 adds terraform_data resource, plan error preservation, metadata API, and GCS/OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees./HTTP backends enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ USE IT
    Store and reference dynamic data during a Terraform run without using workarounds.
    hcl copy

    terraform_data "my_data" {
      input = "value_to_store"
    }

    Create a workspace if it does not exist during automated provisioning.
    shell copy

    terraform workspace select -or-create production

    Export function signatures for tooling or documentation purposes.
    shell copy

    terraform metadata functions -json

    • terraform_data is a new builtin managed resource type that can store data of any type
    • terraform workspace select now accepts the -or-create flag to create workspaces in automated situations
    • terraform metadata functions -json exports Terraform function signatures in machine-readable format
    • -or-create CLI argument for terraform workspace select
    • -json flag for terraform metadata functions subcommand

    +4 more show less

    • KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key configuration in GCS backend allows encryption of state files using Cloud KMS keys via kms_encryption_key
    • GCS backend supports Private Service Connect endpoints via the storage_custom_endpoint argument
    • GOOGLE_BACKEND_IMPERSONATE_SERVICE_ACCOUNT environment variable allows impersonating a different service account when GOOGLE_IMPERSONATE_SERVICE_ACCOUNT is configured for the GCP provider
    • terraform plan can now store a plan file even when encountering errors

    9 details in Everything

25. v1.3.0 Sep 21, 2022 · release notes

    Terraform v1.3.0 adds optional attributes to object types, new string functions (startswith/endswith), timecmp, fmt multi-path support, and provider protocol updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ USE IT
    Define a variable where some object attributes are optional and have defaults.
    hcl copy

    variable "config" {
      type = object({
        host        = string
        port        = optional(number, 8080)
        tls_enabled = optional(bool, true)
      })
    }
    
    resource "example_instance" "main" {
      config = var.config
    }

    Check string prefixes/suffixes directly in configuration logic.
    hcl copy

    locals {
      is_prod = endswith(var.env, "-prod")
      is_internal = startswith(var.region, "internal-")
    }

    Format multiple configuration files in one command.
    shell copy

    terraform fmt file1.tf file2/main.tf modules/network/vpc.tf

    • Supports optional() modifier in variable type constraints to declare optional object attributes with defaults
    • Adds timecmp built-in function for timestamp comparison with UTC offset handling
    • Allows terraform fmt to accept multiple target paths simultaneously
    • Includes full structure of unknownness in terraform show -json output via changed after_unknown representation
    • Supports global acceleration in COS backend

    +2 more show less

    • Calls PlanResourceChange for compatible providers when destroying resource instances
    • Uploads JSON integration format for state to Terraform Cloud alongside state snapshots

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -allow-missing-config flag in terraform import has been removed; an empty configuration block is now required.
    • !The after_unknown field in terraform show -json output changes from a simple boolean to a full structure reflecting the unknownness of complex values.
    • !The azurerm backend no longer supports ADAL (Azure AD Graph) authentication and requires MSAL (Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs.).
    • !Deprecated backends artifactory, etcd, etcdv3, manta, and swift have been removed; legacy backend name azure has been removed.
26. v1.2.0 May 18, 2022 · release notes

    Terraform v1.2 adds precondition/postcondition checks, replace_triggered_by lifecycle argument, and TF_TOKEN_ env vars for credentials

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Validate that a resource configuration meets specific requirements before deployment proceeds.
    hcl copy

    resource "example_resource" "foo" {
      precondition {
        condition     = var.size >= 10
        error_message = "Size must be at least 10."
      }
    }

    Trigger recreation of a resource when its dependency changes.
    hcl copy

    resource "aws_instance" "web" {
      lifecycle {
        replace_triggered_by = [aws_database_instance.db.id]
      }
    }

    Authenticate Terraform to a remote service using an environment variable token.
    shell copy

    export TF_TOKEN_app_terraform_io=abc123token
    terraform plan

    • precondition and postcondition check blocks for resources, data sources, and module output values
    • replace_triggered_by new lifecycle argument for managed resources
    • Credential support via TF_TOKEN_ environment variable for Terraform-native services
    • TF_CLOUD_ORGANIZATION and TF_CLOUD_HOSTNAME as fallbacks for cloud block arguments
    • TF_WORKSPACE as implicit single-workspace configuration when cloud block lacks explicit workspaces config

    +5 more show less

    • AzureRM Backend defaults to MSAL (Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs.) for authentication
    • AzureRM Backend supports authenticating as a service principal using OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.
    • ssh provisioner connection now supports SSH over HTTP proxy
    • SSH client for provisioners now supports newer key algorithms
    • terraform show -json now includes exact type information for output values

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Terraform CLI no longer supports TLS v1.0 and v1.1 for outgoing connections; server must support TLS v1.2
    • !Terraform CLI will no longer accept CA certificates signed using the SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. hash function
    • !Official Linux packages for the v1.2 series now require Linux kernel version 2.6.32 or later
27. v1.1.9 Apr 20, 2022 · release notes

    Terraform v1.1.9 adds support for Run Tasks to execute post-plan hooks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.9 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.1.9

    • Adds run tasks support as a Terraform Cloud integration for executing remote operations during the post plan stage of a run

    1 detail in Everything

28. v1.1.5 Feb 2, 2022 · release notes

    Terraform v1.1.5 adds ap-southeast-3 support for S3 backends

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.5 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.1.5

    • Adds ap-southeast-3 as a supported AWS region for the S3 backend (backend/s3)

    1 detail in Everything

29. v1.1.0 Dec 8, 2021 · release notes

    Terraform v1.1.0 adds moved blocks for refactoring resources, a cloud block for native Cloud integration, and nullable variables.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds moved blocks to HCL configuration, allowing module authors to record resource address changes so Terraform automatically migrates state objects during planning.
    • Adds the cloud block inside the terraform settings block to enable native Terraform Cloud integration for CLI-driven runs, including support for per-run variables via the -var flag.
    • Allows declaring variables as nullable = false in HCL to ensure they never hold a null value, falling back to the default if explicitly set to null.
    • Introduces the type() function in terraform console for inspecting the exact type of a value during debugging.
    • Enables terraform workspace delete to remove workspaces containing only data resources and outputs without requiring terraform destroy first.

    +1 more show less

    • Supports Windows 10 built-in OpenSSH Client's SSH Agent for provisioner/remote-exec and provisioner/file in addition to Pageant.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Terraform on macOS now requires macOS 10.13 High Sierra or later; older versions are no longer supported.
    • !The terraform graph command no longer supports -type=validate and -type=eval options.
    • !terraform apply with a previously-saved plan file now verifies provider plugin package checksums more strictly, potentially failing if in-house plugins modify files between plan and apply.
    • !terraform state mv will error when legacy -backup or -backup-out options are used without the -state option on non-local backends.
30. v1.0.11 Nov 10, 2021 · release notes

    Adds sts_endpoint setting for the OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. backend. Improves numeric equality comparison precision.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.11 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.0.11

    └──▷ HOW TO FIND IT
    Configure a custom STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. endpoint via CLI flag if supported by the specific backend provider or wrapper.
    📍terraform init -backend-config='sts_endpoint=https://sts-custom.example.com'
    • Adds sts_endpoint field to the oss backend config to override the default STS service endpoint
    • Numbers in configuration are now compared by protocol representation instead of native float types, reducing spurious drift

    2 details in Everything

31. v1.0.6 Sep 3, 2021 · release notes

    S3 backend gains improved SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. handling and new AWS SDK endpoints

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.6 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.0.6

32. v1.0.3 Jul 21, 2021 · release notes

    Adds resource_drift to -json plan logs, provider protocol v6 support, and max_request_bytes for etcdv3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.3 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.0.3

    └──▷ USE IT
    Inspect external infrastructure changes directly from CI logs without parsing plan text.
    shell copy

    terraform plan -json | jq '.resource_drift'

    • terraform plan -json now includes the resource_drift field to show changes detected outside of Terraform during refresh.
    • Core automatically accepts providers registered with protocol version 6.
    • Backend/etcdv3 gains the max_request_bytes argument to match server request limits.

    3 details in Everything

33. v1.0.1 Jun 24, 2021 · release notes

    Terraform v1.0.1 marks sensitive state values in JSON plan output and enables host DNS resolver on darwin.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.1 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v1.0.1

34. v0.15.4 May 19, 2021 · release notes

    Terraform v0.15.4 adds -refresh-only planning mode and reports external changes in plan output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.4 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.15.4

    └──▷ USE IT
    Plan to update the state with external changes without applying new configuration.
    shell copy

    terraform apply -refresh-only

    Explicitly migrate state when changing backend configurations.
    shell copy

    terraform init -migrate-state

    • Adds -refresh-only flag to terraform plan and terraform apply to explicitly refresh state by detecting external changes without applying configuration diffs
    • Adds -migrate-state flag to terraform init for explicit backend state migration
    • Adds Workload Identity Federation support for the GCS backend via the GOOGLE_APPLICATION_CREDENTIALS environment variable

    3 details in Everything

35. v0.15.3 May 6, 2021 · release notes

    terraform show adds replace reasons to JSON plan output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.3 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.15.3

    • terraform show -json now includes data describing which changes caused a resource to be replaced

    1 detail in Everything

36. v0.15.2 May 5, 2021 · release notes

    Adds -replace flag to plan/apply and -destroy to apply for in-place workflow control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.2 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.15.2

    └──▷ TRY IT
    Force a specific resource to be replaced on the next apply without altering its config.
    copy

    $ terraform apply -replace='aws_instance.web[0]'

    Use apply to trigger a destroy operation, aligning with the plan syntax.
    copy

    $ terraform apply -destroy

    • terraform plan and terraform apply now support the -replace=<address> flag to force a resource instance to be replaced (destroyed and recreated) without changing configuration
    • terraform apply now supports the -destroy flag, providing symmetry with terraform plan -destroy

    2 details in Everything

37. v0.11.15 Apr 26, 2021 · release notes

    Adds configurable HTTP retry options for the backend/http backend and SSH keepalive support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.15 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.11.15

    • Adds retries and retry_sleep_min options to the backend/http configuration block.
    • Adds persistent SSH connection support via keepalives.

    2 details in Everything

38. v0.15.0 Apr 14, 2021 · release notes

    Terraform v0.15.0 adds configuration_aliases, new functions, -lockfile=readonly, separate logging env vars, and Azurerm AzureAD auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    └──▷ TRY IT
    Enable separate debugging logs for core and providers during init.
    copy

    $ TF_LOG_CORE=INFO TF_LOG_PROVIDER=DEBUG terraform init

    Run init without updating the provider lock file for CI/CD workflows managing it externally.
    copy

    $ terraform init -lockfile=readonly

    • required_providers entries can now contain configuration_aliases to declare additional configuration alias names without requiring a configuration block.
    • New one function for concisely converting a zero-or-one element list/set into a single value that might be null.
    • New functions sensitive and nonsensitive allow module authors to explicitly override Terraform's default inference of value sensitivity.
    • terraform init now accepts a -lockfile=readonly option, which suppresses writing changes to the dependency lock file.
    • terraform validate JSON output now includes a code snippet object for each diagnostic containing an excerpt of the source code.

    +1 more show less

    • Core and Provider logs can now be enabled separately using TF_LOG_CORE and TF_LOG_PROVIDER environment variables.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -force option is no longer available on terraform destroy. Use -auto-approve instead
    • !The -lock and -lock-timeout options are no longer available on terraform init
    • !The -verify-plugins=false option is no longer available on terraform init. (Terraform now _always_ verifies plugins.)
    • !The -get-plugins=false option is no longer available on terraform init. (Terraform now _always_ installs plugins.)
    • !The -var and -var-file options are no longer available on terraform validate.
    • !terraform version -json output no longer includes the (previously-unpopulated) revision property
    • !In the gcs backend the path config argument, which was deprecated since Terraform v0.11, is now removed. Use the prefix argument instead.
    • !The deprecated ignore_changes = ["*"] wildcard syntax is no longer supported. Use ignore_changes = all instead.
    • !Previously deprecated quoted variable type constraints are no longer supported.
    • !Terraform will no longer make use of the HTTP_PROXY environment variable to determine proxy settings for connecting to HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. servers.
    • !The atlas backend, which was deprecated since Terraform v0.12, is now removed.
39. v0.14.7 Feb 17, 2021 · release notes

    Terraform v0.14.7 adds Windows target_platform support for remote-exec provisioners and improves JSON output completeness.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.7 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.14.7

    • Adds target_platform = "windows" to the connection block of the remote-exec provisioner to run commands on Windows hosts using the command interpreter
    • Improves terraform show -json to include the full module tree even when child modules have no resources

    2 details in Everything

40. v0.14.6 Feb 4, 2021 · release notes

    Adds AWS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. cached credential support for the S3 backend

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.6 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.14.6

41. v0.14.5 Jan 20, 2021 · release notes

    Terraform v0.14.5 adds scram-sha-256 support to the Postgres backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.5 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.14.5

    • The pg backend now supports the scram-sha-256 authentication method for PostgreSQL connections.

    1 detail in Everything

42. v0.13.6 Jan 6, 2021 · release notes

    Terraform v0.13.6 removes version check on terraform_remote_state data source

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.6 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.13.6

43. v0.14.3 Dec 17, 2020 · release notes

    Adds -raw flag to terraform output and allows sensitive values in for_each map elements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.3 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.14.3

    └──▷ USE IT
    Retrieve a plaintext secret (e.g., a password or API key) from state for direct use in shell scripts without JSON parsing.
    shell copy

    terraform output -raw my_secret_value

    Configure dynamic resource instantiation where the iteration values contain sensitive data, leveraging the new support for sensitive map elements.
    hcl copy

    resource "example" "main" {
      for_each = tomap({
        item1 = var.sensitive_map_value
      })
      val = each.value
    }

    • terraform output -raw: Adds the -raw option to print primitive output values as raw strings instead of quoted JSON.
    • Config for_each: Allows maps with sensitive element values when keys and the map itself are not sensitive.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !terraform init -get-plugins=false now emits a warning as the flag has been a no-op since 0.13.0.
44. v0.14.1 Dec 8, 2020 · release notes

    Adds -ignore-remote-version flag to skip remote version checks in enhanced backend

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.1 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.14.1

    └──▷ TRY IT
    Force a plan against a remote backend even when the local and remote Terraform versions differ, for example to test or resolve a stuck state.
    copy

    $ terraform plan -ignore-remote-version

45. v0.14.0 Dec 2, 2020 · release notes

    Terraform v0.14 adds sensitive variable marking, lock files via terraform init, -chdir flag, and new functions like alltrue.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    └──▷ USE IT
    Mark a database password variable so it does not appear in logs or plans.
    hcl copy

    variable "db_password" {
      description = "Password for the database"
      type        = string
      sensitive   = true
    }

    Run a plan in a specific directory without cd-ing out of your current shell location.
    copy

    $ terraform -chdir=/path/to/infra apply

    Check if all items in a list are true using the new collection functions.
    hcl copy

    alltrue([true, true, true])

    • terraform init now generates a .terraform.lock.hcl lock file in the configuration directory to pin provider versions for reproducible installs
    • Adds sensitive = true argument to variable blocks to suppress sensitive input values from plan output and propagate sensitivity through expressions
    • New global -chdir=<path> CLI flag allows switching working directories before executing a subcommand without affecting the calling shell
    • Adds experimental concise diff renderer for terraform plan/apply, disabled via TF_X_CONCISE_DIFF=0 environment variable
    • Adds alltrue and anytrue functions in the Terraform language for evaluating boolean conditions across collections

    +2 more show less

    • Adds textencodebase64 and textdecodebase64 functions for encoding text in character encodings other than UTF-8
    • terraform login now supports OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. application scopes for token generation

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Outputs that reference sensitive values must be defined with sensitive = true or Terraform will error at plan time
    • !The version argument inside provider configuration blocks now generates an explicit deprecation warning; use provider requirements declarations instead
    • !The terraform 0.13upgrade subcommand and associated upgrade mechanisms are no longer available
    • !The debug command has been removed
46. v0.13.2 Sep 2, 2020 · release notes

    Adds network-based provider mirrors via HTTP for offline or restricted network installations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.2 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.13.2

    • Adds network mirror support to provider installation configuration
    • Adds environment variable support to the backend/http backend configuration

    2 details in Everything

47. v0.13.1 Aug 26, 2020 · release notes

    Terraform v0.13.1 adds TF_APPEND_USER_AGENT env var for S3 backend and extends cidrsubnet/cidrhost to >32 bits.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.1 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.13.1

    └──▷ USE IT
    Append custom identification data (e.g., team name or pipeline ID) to S3 backend API requests for easier log correlation.
    shell copy

    TF_APPEND_USER_AGENT='my-org/s3-backend' terraform init

    • Adds support for appending data to the User-Agent request header via the TF_APPEND_USER_AGENT environment variable in the S3 backend
    • Extends cidrsubnet and cidrhost to support address extensions of more than 32 bits
    • Allows provider plugin search directories to be symlinks

    3 details in Everything

48. v0.13.0 Aug 10, 2020 · release notes

    Terraform v0.13 adds count/for_each for modules, terraform state replace-provider, and Kubernetes remote state backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    └──▷ USE IT
    Deploy three identical VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. using a single module block with dynamic indexing.
    config copy

    module "vpc" {
      source = "..."
      count  = 3
      cidr_block = cidrsubnet(var.base_cidr, 8, count.index)
    }

    Rename a provider in state to fix drift or migration without re-importing resources.
    shell copy

    terraform state replace-provider registry.terraform.io/hashicorp/aws registry.terraform.io/myco/aws

    Validate that a port number is within the valid range when passing it as a variable.
    config copy

    variable "port" {
      type = number
      validation {
        condition     = var.port >= 1024 && var.port <= 65535
        error_message = "Port must be between 1024 and 65535."
      }
    }

    • module blocks now accept count and for_each arguments to create multiple instances from a single block.
    • Modules can use the depends_on meta-argument to ensure resource changes apply after specific targets.
    • Custom validation rules can be defined using the validation block inside variable blocks.
    • New Kubernetes backend stores state snapshots as Kubernetes secrets.
    • New terraform state replace-provider subcommand allows changing the selected provider for existing resource instances in state.

    +2 more show less

    • New terraform providers mirror subcommand constructs or updates a local filesystem mirror directory for required providers.
    • terraform version -json produces machine-readable version information.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !-provider option is removed from terraform import.
    • !Inside provisioner blocks with when = destroy, referring to objects other than self, count, or each is no longer valid.
    • !At most one terraform required_providers block is permitted per module; multiple blocks must be consolidated.
    • !Official MacOS builds are no longer compatible with Mac OS 10.10 Yosemite; minimum is 10.11 El Capitan.
    • !Official FreeBSD builds are no longer compatible with FreeBSD 10.x; minimum is 11.2 or later.
    • !backend/oss TableStore schema now requires a primary key named LockID of type String.
    • !lock_table, skip_get_ec2_platforms, and skip_requesting_account_id arguments are removed from backend/s3.
    • !Credential source preference order for backend/s3 now considers EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance profile credentials as lower priority than shared configuration, web identity, and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. role credentials.
    • !AWS_METADATA_TIMEOUT environment variable is no longer used for backend/s3.
49. v0.12.26 May 27, 2020 · release notes

    Adds -target option to remote operations and a new provider lifecycle mode for automated testing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.26 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.26

    • terraform apply with remote operations now accepts the -target flag to scope the plan to specific resources (server-side support pending)
    • Introduces a special new provider lifecycle mode where plugins are assumed to be controlled by an external process

    2 details in Everything

50. v0.12.25 May 13, 2020 · release notes

    Adds support for S3 region af-south-1 and force push to remote backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.25 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.25

    • Backend/S3: Automatic region validation now supports the new af-south-1 (Africa (Cape Town)) region.

    1 detail in Everything

51. v0.12.24 Mar 19, 2020 · release notes

    Windows executables are now signed with a HashiCorp certificate.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.24 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.24

    • Adds Windows executable signing for 32-bit and 64-bit binaries to remove unknown publisher warnings.

    1 detail in Everything

52. v0.12.22 Mar 5, 2020 · release notes

    Adds configurable retries and timeouts for remote registry requests in Terraform v0.12.22

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.22 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.22

    • Add configurable retries for module and provider discovery requests to the remote registry
    • Add configurable request timeout for the remote registry client

    2 details in Everything

53. v0.12.21 Feb 19, 2020 · release notes

    Adds terraform login/logout commands and a new cos backend for Tencent Cloud Storage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.21 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.21

    • Adds backend/cos to use Tencent Cloud Object Storage as a remote state backend
    • Adds terraform login command with support for UI-generated tokens
    • Adds terraform logout command to remove local credentials
    • Adds setsubtract function in lang/funcs

    4 details in Everything

54. v0.12.20 Jan 22, 2020 · release notes

    Terraform v0.12.20 adds try and can built-in functions and optional required_providers syntax.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.20 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.20

    └──▷ USE IT
    Safely access nested object attributes that might not exist without triggering a nil pointer error.
    text copy

    output "name" {
      value = try(var.user.address.street_name, "Unknown")
    }

    Define expected providers and their version constraints within the root module configuration.
    text copy

    terraform {
      required_providers {
        aws = "~> 2.0"
        azurerm = ">= 1.36"
      }
    }

    • Adds new built-in functions try and can in configuration to handle data structures with unknown static shapes
    • Adds new, optional syntax for the required_providers setting in terraform blocks

    2 details in Everything

55. v0.12.19 Jan 8, 2020 · release notes

    Terraform v0.12.19 adds caching for registry metadata and tighter state-mv reference handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.19 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.19

    └──▷ USE IT
    Ensure clean state migrations by using state mv which now automatically cleans up stale source references.
    shell copy

    terraform state mv 'module.old.module_name' 'module.new.module_name'

    • terraform init caches Terraform Registry metadata responses when handling multiple references to the same module.

    1 detail in Everything

56. v0.12.18 Dec 11, 2019 · release notes

    Adds -compact-warnings flag to terraform plan/apply and deprecates non-self refs in destroy provisioners

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.18 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.18

    └──▷ USE IT
    Run a plan where you only want to see warning summaries if no errors occur, keeping the output clean.
    shell copy

    terraform plan -compact-warnings

    • terraform plan and terraform apply now accept the -compact-warnings flag to output only warning summaries when no errors are present.
    • Destroy-time provisioners (when = destroy) and their associated connection blocks now warn when referencing objects other than self, count, or each.
    • Darwin releases are now signed and notarized per Apple requirements, allowing execution on MacOS 10.15+ without manual Gatekeeper exceptions.

    3 details in Everything

57. v0.12.17 Dec 2, 2019 · release notes

    Adds trim and related string manipulation functions to the template language.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.17 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.17

    └──▷ USE IT
    Remove leading and trailing whitespace from resource tags during plan.
    hcl copy

    output "tags" {
      value = trim(var.raw_tags, " ")
    }

    • lang/funcs: Add trim* functions
    • cli: Consolidates warnings with identical summary text into single items to reduce output noise

    2 details in Everything

58. advisory CVE-2019-19316 Dec 2, 2019 · issue 128
    • CVE-2019-19316: Cleartext transmission of Terraform state snapshots when using Azure backend with certain SAS tokens (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects < 0.12.17)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
59. v0.12.14 Nov 13, 2019 · release notes

    Terraform v0.12.14 adds HTTP proxy support for the Artifactory backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.14 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.14

    └──▷ TRY IT
    Use a corporate proxy to store Terraform state in Artifactory.
    copy

    $ export HTTP_PROXY='http://proxy.corp:8080'
    export HTTPS_PROXY='http://proxy.corp:8081'
    terraform init

    • Backend/artifactory now honors the HTTP_PROXY and HTTPS_PROXY environment variables.

    1 detail in Everything

60. v0.12.11 Oct 17, 2019 · release notes

    Adds role_arn support for S3 backend and .terraformignore file handling for Remote backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.11 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.11

    └──▷ TRY IT
    Assume a role specified in ~/.aws/config when initializing the S3 backend.
    copy

    $ terraform init -backend-config='backend_config' # where config contains role_arn = "arn:aws:..."

    Prevent .terraformignore patterns from being uploaded to Terraform Cloud during plans/applies.
    copy

    $ echo '*.tfvars' > .terraformignore
    terraform plan

    • backend/s3: Support role_arn in AWS configuration files
    • backend/remote: Ignore .terraform/ and .git/ directories by default; supports .terraformignore to exclude files

    2 details in Everything

61. v0.12.10 Oct 7, 2019 · release notes

    Terraform v0.12.10 adds parseint and cidrsubnets functions, GCS OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. auth, and -target warnings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.10 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.10

    • Adds -target warning in terraform plan and terraform apply to alert users when results may be incomplete.
    • Adds new parseint function in config to parse strings containing digits as integers in various bases.
    • Adds new cidrsubnets function in config to allocate multiple consecutive subnet prefixes in a single call.
    • Enables OAuth2 token authentication for the backend/google (GCS backend).

    4 details in Everything

62. v0.12.9 Sep 17, 2019 · release notes

    Terraform v0.12.9 adds accept_license for Habitat provisioners and improves for_each error messaging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.9 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.9

    └──▷ USE IT
    Automate the Habitat client installation by accepting the license programmatically.
    hcl copy

    provisioner "habitat" {
        accept_license = true
        # ... other arguments
    }

    • provisioners/habitat: add accept_license argument to automate EULA acceptance
    • config: improve source addressing in unknown value errors for for_each

    2 details in Everything

63. v0.12.8 Sep 4, 2019 · release notes

    Terraform v0.12.8 adds the fileset function for globbing local files and a remote-state skip schema option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.8 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.8

    └──▷ TRY IT
    Glob local directory for .tfvars files to pass as inputs.
    copy

    $ fileset(path.root, "**/*.tfvars")

    • Adds new fileset function in lang/funcs to find static local files matching a glob pattern
    • Adds skip_schema_creation option to the remote-state/pg backend

    2 details in Everything

64. v0.12.7 Aug 22, 2019 · release notes

    Adds regex and regexall functions for string pattern matching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.7 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.7

    └──▷ TRY IT
    Extract the semantic version number from a string containing mixed content.
    copy

    $ regex("[0-9]+\\.[0-9]+\\.[0-9]+", "release-v1.2.3-final")

    Find all email addresses within a larger text block for validation or logging.
    copy

    $ regexall("[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}", "Contact alice@example.com or bob@test.org")

    • regex(pattern, string) allows applying a regular expression pattern to a string and retrieving the first matching substring.
    • regexall(pattern, string) allows applying a regular expression pattern to a string and retrieving all matching substrings.

    2 details in Everything

65. v0.12.6 Jul 31, 2019 · release notes

    Terraform v0.12.6 adds for_each to resources and assume role support for OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. backend

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.6 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.6

    • Added for_each meta-argument to resources
    • backend/oss: added support for assume role config
    • backend/s3: Add support for assuming role via web identity token via the AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables

    3 details in Everything

66. v0.12.5 Jul 18, 2019 · release notes

    Terraform v0.12.5 adds credential_process support in S3 backend and aborts hung SSH connections

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.5 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.5

    • S3 backend now supports assuming a role using credential_process from the shared AWS configuration file, enabling use of profiles containing both credential_process and role_arn configurations.
    • SSH connections are aborted when the server is no longer responding, improving connection stability.
    • Support added for the diffie-hellman-group-exchange-sha256 key exchange method in SSH connections.

    3 details in Everything

67. v0.12.4 Jul 11, 2019 · release notes

    Terraform v0.12.4 adds abspath function and Swift state object name customization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.4 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.4

    • lang/funcs: new abspath function returns the absolute path to a given file
    • backend/swift: support for user configured state object names in swift containers

    2 details in Everything

68. v0.12.3 Jun 24, 2019 · release notes

    Adds Google Cloud Storage module source support and S3 backend role chaining from AWS shared config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.3 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.3

    └──▷ USE IT
    Fetch a module directly from a Google Cloud Storage bucket without local checkout.
    text copy

    module "example" {
      source = "gcs::https://www.storage.googleapis.com/{{_BUCKET_NAME}}/{{_MODULE_PATH}}"
    }

    Use an IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role from AWS shared configuration files for the S3 backend.
    text copy

    terraform {
      backend "s3" {
        bucket = "my-bucket"
        key    = "state.tfstate"
        region = "us-east-1"
        # Chaining is automatic via AWS shared config
      }
    }

    • config: add GCS source support for modules
    • backend/s3: Support for chaining assume IAM role from AWS shared configuration files

    2 details in Everything

69. v0.12.2 Jun 12, 2019 · release notes

    Adds puppet provisioner, range, yamldecode, uuidv5 functions, and Alibaba OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. backend support in Terraform v0.12.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.2 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.2

    └──▷ TRY IT
    Generate a predictable UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. based on a resource name for consistent naming across environments.
    copy

    $ resource "example" "name" {
      id = uuidv5("namespace", self.name)
    }

    Parse a YAML string directly in your configuration to configure resources dynamically.
    copy

    $ locals {
      config = yamldecode("""
    name: example
    value: true
    """)
    }

    Store Terraform state in Alibaba OSS for centralized remote management.
    copy

    $ terraform {
      backend "oss" {
        bucket = "my-terraform-state"
        prefix = "env/prod/"
        endpoint = "oss-cn-hangzhou.aliyuncs.com"
      }
    }

    • Adds the puppet provisioner for executing Puppet manifests on managed resources
    • Adds the range() function to generate a list of integers from start to end
    • Adds the yamldecode() function and experimental yamlencode() function for parsing and serializing YAML data within Terraform configurations
    • Adds the uuidv5() function to generate name-based UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. using SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. hashing
    • Adds support for Alibaba Object Storage Service (OSS) as a remote state backend via backend/oss

    5 details in Everything

70. v0.12.0 May 22, 2019 · release notes

    Terraform v0.12.0 introduces HCL2 language overhaul with for expressions, dynamic blocks, new builtin functions, and -json output for validate.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    • terraform validate now accepts the -json flag to produce machine-readable output.
    • Supports dynamic configuration blocks to generate nested config blocks from lists/maps.
    • Adds the for expression construct for transforming and filtering list or map elements.
    • Generalized splat operator allows applying * syntax to any list value, not just resources with count.
    • Adds jsondecode interpolation function to parse JSON strings into native types.

    +5 more show less

    • Adds csvdecode interpolation function to load lists of maps from CSV strings.
    • Adds the templatefile built-in function to render templates from files in the language.
    • Adds the formatdate built-in function for creating machine-oriented timestamp strings.
    • Adds the reverse built-in function to reverse the order of items in a list.
    • Adds the strrev built-in function to reverse the order of Unicode characters in a string.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The wire protocol for provider and provisioner plugins has changed; plugins built against prior versions are not compatible with Terraform v0.12.
    • !Serialization formats for persisted state snapshots and saved plans have changed, requiring third-party tools to update parsers.
71. v0.11.14 May 16, 2019 · release notes

    Adds terraform 0.12checklist CLI command to detect upgrade preparation steps

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.14 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.11.14

    └──▷ TRY IT
    Check current configuration for compatibility issues before upgrading to Terraform 0.12
    copy

    $ terraform 0.12checklist

    • terraform 0.12checklist command detects and reports on some preparation steps that will make a subsequent Terraform 0.12 upgrade smoother.
    • backend/s3: Add max_retries configuration for retry attempts
    • backend/remote: Do not unlock a workspace after a failed state upload

    3 details in Everything

72. v0.11.11 Dec 14, 2018 · release notes

    Adds service discovery version constraints and detailed remote backend compatibility info

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.11 https://github.com/hashicorp/terraform.git
    # already have the repo? check out this version:
    $ git checkout v0.11.11

    • Add support to retrieve version constraints to service discovery
    • backend/remote: Return detailed version (in)compatibility information

    2 details in Everything