The provider block — configuring API connections

Crisp answer: Provider blocks configure how Terraform connects to an external API. Every resource belongs to a provider. You must declare and configure a provider before using its resources.

Basic provider configuration:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"   # any 5.x version
    }
  }
  required_version = ">= 1.9"
}

provider "aws" {
  region = "eu-west-2"

  # Credentials: do not hardcode. Use one of:
  # 1. Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
  # 2. AWS profile: profile = "my-profile"
  # 3. IAM instance profile (on EC2 or ECS)
  # 4. IAM role assumption
}

Multiple provider instances — provider aliases:

# Deploy to two regions simultaneously
provider "aws" {
  region = "eu-west-2"
  alias  = "london"
}

provider "aws" {
  region = "us-east-1"
  alias  = "virginia"
}

resource "aws_s3_bucket" "eu" {
  provider = aws.london    # Uses the london alias
  bucket   = "my-bucket-eu"
}

resource "aws_s3_bucket" "us" {
  provider = aws.virginia  # Uses the virginia alias
  bucket   = "my-bucket-us"
}

Cross-account deployment:

provider "aws" {
  region = "eu-west-2"
  alias  = "prod"

  assume_role {
    role_arn = "arn:aws:iam::123456789012:role/TerraformDeployRole"
  }
}

resource "aws_eks_cluster" "main" {
  provider = aws.prod
  name     = "prod-cluster"
}

Version constraints:

version = "5.58.0"    # Exact version
version = "~> 5.0"    # Any 5.x (most common — allows patch updates)
version = ">= 5.0"    # 5.0 or higher (open-ended, less safe)
version = ">= 5.0, < 6.0"  # Equivalent to ~> 5.0 but explicit

What to say in the interview:

"The provider block configures the connection to a specific API. Required providers with version constraints go in the terraform block, and provider configuration like region and credentials goes in the provider block. For credentials I never hardcode — I rely on environment variables or IAM roles. Provider aliases let you target multiple regions or multiple accounts in the same Terraform root by creating multiple instances of the same provider, and resources reference them with the provider argument."