A provider source address names where a provider comes from: a hostname, a namespace and a type, such as registry.terraform.io/hashicorp/aws. For the public registry you may omit the hostname and write hashicorp/aws. Checking the namespace in review is how you notice an unexpected publisher.
Anatomy of an address
The origin registry for a provider is encoded in its source address. Terraform allows you to leave out the hostname for providers on registry.terraform.io, so hashicorp/aws and the full form mean the same thing. In a required_providers block, each local name maps to a source address and a version constraint.
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.0"
}
}
}
Why the address matters
The namespace identifies who published the provider. Two providers with similar types but different namespaces are different programs. A change from one namespace to another in a pull request changes who supplies code that runs with your cloud credentials. Local names are only labels inside your module, so the source line is what decides.
Review checklist
| Check | Question |
|---|---|
| Namespace | Is the publisher the one you expect? |
| Hostname | Is it the public registry, or a private host you control? |
| Type | Does the name match the provider you meant, with no near miss? |
| Version | Is it constrained, and does the lock file agree? |
| New entry | Has the lock file gained a provider block to match? |
Shorthand and mirrors
The omitted hostname rule also applies to installation patterns. In provider_installation, registry.terraform.io/hashicorp/* and hashicorp/* are equivalent, and */* is shorthand for registry.terraform.io/*/*. If you use a mirror, patterns decide which providers it serves, so keep them precise.
Steps for a safe addition
- Find the provider on its registry page and note the namespace and source link.
- Write the full source address in your block.
- Run
terraform initand read the key ID message. - Commit the lock file change with the block change.
- Ask a second reviewer to confirm the namespace.
Modules that bring providers
A child module can require providers too. When you add an external module, check its required_providers blocks for sources you did not choose, because init will select and record them in the lock file.
Quick check
Can I leave out the hostname?
For providers on registry.terraform.io, yes. Terraform allows the shorter form.
Is the local name the source of truth?
No. The source argument decides which provider is installed.
Will init add child module providers to the lock file?
Yes. A new provider requirement from a module is selected and recorded.
Safeguard offers SBOM and dependency scanning and policy gates that can block a pull request on findings, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- Terraform docs: terraform block, required_providers
- Terraform docs: CLI configuration file
- Terraform docs: Dependency Lock File
Last reviewed: 19 October 2026.
