fix(terraform): align provider version floors across modules

.pre-commit-config.yaml

@@ -29,17 +29,6 @@ repos:
         name: Terraform format
       - id: terraform_validate
         name: Terraform validate
-        # Excluded: two orphan modules (not instantiated by any
-        # environment) whose resource bodies use `dynamic` blocks
-        # around scalar attributes — invalid HCL in any azurerm
-        # version. They were silently broken until terraform_validate
-        # started running in CI. Tracked separately; remove the
-        # exclusion as part of that cleanup.
-        exclude: |
-          (?x)^(
-            terraform/modules/compute/azure/cleanup-function/|
-            terraform/modules/registry/azure/
-          )
       - id: terraform_tflint
         name: Terraform lint
         args:

terraform/environments/aws/ci-cd-permissions/main.tf

@@ -3,8 +3,11 @@ terraform {
 
   required_providers {
     aws = {
+      # This bootstrap root is already applied with the 6.x provider line
+      # (see .terraform.lock.hcl); pinned to ~> 6.0 rather than the
+      # workload environments' ~> 5.0 to match the committed lock file.
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "~> 6.0"
     }
   }
 

terraform/modules/compute/aws/cleanup-lambda/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "~> 5.0"
     }
   }
 }

terraform/modules/compute/aws/fargate/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "~> 5.0"
     }
   }
 }

terraform/modules/compute/azure/cleanup-function/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 4.0"
+      version = "~> 3.0"
     }
   }
 }

terraform/modules/compute/gcp/cleanup-function/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5.0"
+      version = "~> 5.0"
     }
   }
 }

terraform/modules/iam/azure/cudly-reservation-role/main.tf

@@ -3,6 +3,10 @@ terraform {
 
   required_providers {
     azurerm = {
+      # Deliberately >= 3.0 (not ~> 3.0): this module is consumed by both
+      # terraform/environments/azure/ci-cd-permissions (azurerm ~> 3.0) and
+      # iac/federation/azure-target/terraform (azurerm ~> 4.0), so the
+      # constraint must intersect with both provider lines.
       source  = "hashicorp/azurerm"
       version = ">= 3.0"
     }

terraform/modules/monitoring/aws/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = "~> 5.0"
     }
   }
 }

terraform/modules/monitoring/azure/versions.tf

@@ -3,12 +3,8 @@ terraform {
 
   required_providers {
     azurerm = {
-      # Pinned to ~> 4.0 (not the codebase's ~> 3.0 azurerm convention)
-      # to match this module's previously-committed lock file (4.61.0).
-      # The Azure environment doesn't currently instantiate this module
-      # so the version split doesn't conflict with any running plan.
       source  = "hashicorp/azurerm"
-      version = "~> 4.0"
+      version = "~> 3.0"
     }
   }
 }