github.com/muratcelep/terraform@v1.1.0-beta2-not-internal-4/website/docs/language/v1-compatibility-promises.html.md (about) 1 --- 2 layout: "language" 3 page_title: "Terraform v1.0 Compatibility Promises" 4 sidebar_current: "docs-v1-compatibility" 5 description: |- 6 From Terraform v1.0 onwards the Terraform team promises to preserve backward 7 compatibility for most of the Terraform language and the primary CLI 8 workflow, until the next major release. 9 --- 10 11 # Terraform v1.0 Compatibility Promises 12 13 The release of Terraform v1.0 represents an important milestone in the 14 development of the Terraform language and workflow. Terraform v1.0 is a stable 15 platform for describing and managing infrastructure. 16 17 In this release we're defining a number of Terraform behaviors that we intend 18 to remain compatible with throughout the 1.x releases: 19 20 * A large subset of Terraform language features. 21 * A more conservative subset of the Terraform CLI workflow commands. 22 * The wire protocol for communication between Terraform Core and Terraform 23 providers. 24 * The wire protocols for installation of Terraform providers and external 25 Terraform modules. 26 27 Our intention is that Terraform modules written for Terraform v1.0 will 28 continue to plan and apply successfully, without required changes, throughout 29 the v1.x releases. 30 31 We also intend that automation built around the workflow subset described in 32 this document will work without changes in all future v1.x releases. 33 34 Finally, we intend that providers built against the currently-documented 35 provider wire protocol will be compatible with all future Terraform v1.x 36 releases targeting the same operating system and architecture, without the 37 need for source code modification or binary recompilation. 38 39 In short, we aim to make upgrades between v1.x releases straightforward, 40 requiring no changes to your configuration, no extra commands to run upgrade 41 steps, and no changes to any automation you've set up around Terraform. 42 43 The Terraform v1.x series will be actively maintained for at least 18 months 44 after v1.0. 45 46 The following sections include some specific guidance on what we will promise 47 throughout the v1.x series, for those who would like full details. At 48 a higher level though, we don't intend to make any changes that would cause 49 existing modules or automation to require changes when upgrading to a new 50 v1.x release. We will generally treat compatibility problems in new Terraform 51 CLI releases as bugs to be fixed unless there was a very significant 52 justification for the change, such as in addressing a critical security 53 problem or matching with a breaking change to a remote dependency that isn't 54 directly under our control. 55 56 ## The Terraform Language 57 58 The main Terraform Language includes the language syntax, the top-level 59 structures such as `resource`, `module`, and `provider` blocks, the 60 "meta-arguments" in those blocks, and the documented semantics and behaviors 61 for the operators and built-in functions available for use in expressions. 62 63 There is not a single formal specification for the Terraform language, but the 64 Configuration section of the documentation on the Terraform website serves as a 65 description of the language features and their intended behaviors. 66 67 The following top-level blocks and their defined "meta-arguments" (that is, 68 arguments defined by Terraform Core rather than by external plugins such as 69 providers) will retain their current functionality: 70 71 * [`resource`](/docs/language/resources/) and 72 [`data`](/docs/language/data-sources/) blocks to 73 declare resources, including their nested block types `lifecycle`, 74 `connection`, and `provisioner`, and their meta-argument `provider`. 75 * [`module`](/docs/language/modules/syntax.html) blocks to call other modules, 76 and its meta-argument `providers`. 77 * The [`count`](/docs/language/meta-arguments/count.html), 78 [`for_each`](/docs/language/meta-arguments/for_each.html), and 79 [`depends_on`](/docs/language/meta-arguments/depends_on.html) meta-arguments 80 in `resource`, `data`, and `module` blocks. 81 * [`provider`](/docs/language/providers/configuration.html) blocks to configure 82 providers, and the `alias` meta-argument. 83 * [`variable`](/docs/language/values/variables.html#declaring-an-input-variable), 84 [`output`](/docs/language/values/outputs.html#declaring-an-output-value), and 85 [`locals`](/docs/language/values/locals.html#declaring-a-local-value) blocks 86 for declaring the various kinds of named values in a module. 87 * [`terraform`](/docs/language/settings/) blocks, including the nested 88 [`required_version`](/docs/language/settings/index.html#specifying-a-required-terraform-version) 89 and 90 [`required_providers`](/docs/language/providers/requirements.html#requiring-providers) 91 arguments, and nested 92 [`backend`](/docs/language/settings/backends/configuration.html#using-a-backend-block) 93 blocks for backend configuration. 94 95 We also intend to keep compatibility with all 96 [expression operators](/docs/language/expressions/) and 97 [built-in functions](/docs/language/functions/), with the exception of 98 references to 99 [`terraform.workspace`](/docs/language/expressions/references.html#terraform-workspace), 100 whose behavior may change as part of future changes to the workspace model. 101 102 We intend to retain broad compatibility with Terraform language features, with 103 a few specific caveats: 104 105 * We consider a configuration to be valid if Terraform can create and apply 106 a plan for it without reporting any errors. 107 108 A configuration that currently produces errors might generate different 109 errors or exhibit other non-error behaviors in a future version of 110 Terraform. A configuration that generates errors during the apply phase 111 might generate similar errors at an earlier phase in future, because 112 we generally consider it better to detect errors in as early a phase as 113 possible. 114 115 Generally-speaking, the compatibility promises described in this document 116 apply only to valid configurations. Handling of invalid configurations is 117 always subject to change in future Terraform releases. 118 * If the actual behavior of a feature differs from what we explicitly 119 documented as the feature's behavior, we will usually treat that as a bug 120 and change the feature to match the documentation, although we will avoid 121 making such changes if they seem likely to cause broad compatibility problems. 122 We cannot promise to always remain "bug-compatible" with previous releases, 123 but we will consider such fixes carefully to minimize their impact. 124 * Any experimental features may change or may be removed entirely from future 125 releases. Terraform always produces a warning when an experimental language 126 feature is active, to make you aware of that risk. We don't recommend using 127 experimental features in production modules. 128 * We will introduce new language features, and if you start using them then 129 your configuration won't work with prior Terraform versions that didn't 130 support those features yet. 131 * Terraform Providers are separate plugins which can change independently of 132 Terraform Core and are therefore not subject to these compatibility promises. 133 If you upgrade any of the providers you are using then you might need to 134 change provider or resource configurations related to those providers. 135 * A small number of features remain deprecated with explicit warnings in 136 Terraform v1.0. Those deprecation cycles will end in a future v1.x release, 137 at which point we will remove the corresponding features. 138 139 ## Workflow 140 141 There is a set of often used Terraform workflows, which we are calling 142 _protected workflows_. We will not remove these commands, subcommands, and 143 flags or make backward-incompatible changes to protected workflow 144 functionality. If we accidentally change these, we will consider 145 backwards-incompatible changes to core workflows as bugs to be fixed. For a 146 list of the command and option combinations that are part of protected 147 workflows, see [Protected Workflow Commands](#protected-workflow-commands). 148 There is another set of commands that we are explicitly _not_ making 149 compatibility promises about, because we expect their functionality to change 150 in v1.x releases: see [Commands That Might Change](#commands-that-might-change). 151 152 The supported ways for external software to interact with Terraform are via 153 the JSON output modes offered by some commands and via exit status codes. 154 We may extend certain JSON formats with new object properties but we will not 155 remove or make breaking changes to the definitions of existing properties. 156 157 Natural language command output or log output is not a stable interface and 158 may change in any new version. If you write software that parses this output 159 then it may need to be updated when you upgrade Terraform. If you need access 160 to data that is not currently available via one of the machine-readable JSON 161 interfaces, we suggest opening a feature request to discuss your use-case. 162 163 ## Upgrading and Downgrading 164 165 Throughout the v1.x series of releases, we intend that you should be able to 166 switch to a newer Terraform version and use it just as before, without any 167 special upgrade steps. 168 169 You should be able to upgrade from any v1.x release to any later v1.x release. 170 You might also be able to downgrade to an earlier v1.x release, but that isn't 171 guaranteed: later releases may introduce new features that earlier versions 172 cannot understand, including new storage formats for Terraform state snapshots. 173 174 If you make use of features introduced in a later v1.x release, your 175 configuration won't be compatible with releases that predate that feature. 176 For example, if a language feature is added in v1.3 and you start using it, your 177 Terraform configuration will no longer be compatible with Terraform v1.2. 178 179 ## Providers 180 181 Terraform providers are separate plugins which communicate with Terraform using 182 a documented protocol. Therefore these compatibility promises can only cover 183 the "client" side of this protocol as implemented by Terraform Core; the 184 behaviors of individual providers, including which resource types they support 185 and which arguments they expect, are decided by the provider development teams 186 and can change independently of Terraform Core releases. 187 188 If you upgrade to a new version of a provider then you might need to change 189 the parts of your configuration which are interpreted by that provider, even 190 if you are still using a Terraform v1.x release. 191 192 ### Provider Installation Methods 193 194 Terraform normally installs providers from a provider registry implementing 195 [the Provider Registry Protocol](/docs/internals/provider-registry-protocol.html), 196 version 1. All Terraform v1.x releases will remain compatible with that 197 protocol, and so correctly-implemented provider registries will stay compatible. 198 199 Terraform also supports installation of providers from 200 [local filesystem directories](/docs/cli/config/config-file.html#filesystem_mirror) 201 (filesystem mirrors) and from 202 [network mirrors](/docs/cli/config/config-file.html#network_mirror) 203 (implementing [the Provider Mirror Protocol](/docs/internals/provider-network-mirror-protocol.html). 204 All Terraform v1.x releases will remain compatible with those installation 205 methods, including 206 [the Implied Local Mirror Directories](/docs/cli/config/config-file.html#implied-local-mirror-directories). 207 208 Specific provider registries or network mirrors are run independently from 209 Terraform itself and so their own behaviors are not subject to these 210 compatibility promises. 211 212 ### Provider Protocol Versions 213 214 The current major version of the provider plugin protocol as of Terraform v1.0 215 is version 5, which is defined by a combination of a Protocol Buffers schema 216 describing the physical wire formats and by additional prose documentation 217 describing the expected provider behaviors. 218 219 We will support protocol version 5 throughout the Terraform v1.x releases. If 220 we make new minor revisions to protocol version 5 in later releases then we 221 will design them such that existing plugins will continue to work, as long as 222 they correctly implemented the protocol. 223 224 We may introduce new major versions of the protocol during the v1.x series. If 225 so, we will continue to support protocol version 5 alongside those new versions. 226 Individual provider teams might decide to remove support for protocol version 5 227 in later releases, in which case those new provider releases will not be 228 compatible with all of the Terraform v1.x releases. 229 230 ## External Modules 231 232 Terraform modules are reusable infrastructure components written in the 233 Terraform language. Some modules are "external" in the sense that Terraform 234 automatically installs them from a location other than the current 235 configuration directory, in which case their contents could change 236 independently of changes to your local modules, of the providers you use, 237 and of Terraform itself. 238 239 ### Module Installation Methods 240 241 Terraform supports installing child modules from a number of different 242 [module source types](/docs/language/modules/sources.html). We will continue 243 to support all of the existing source types throughout the v1.x releases. 244 245 One of the supported source types is a module registry implementing 246 [the Module Registry Protocol](/docs/internals/module-registry-protocol.html) 247 version 1. All Terraform v1.x releases will remain compatible with correct 248 implementations of that protocol. 249 250 Some module source types work directly with services or protocols defined and 251 run by third parties. Although we will not remove Terraform's own client-side 252 support for those, we cannot guarantee that their owners will keep those 253 services running or that they will remain compatible with Terraform's client 254 implementations. 255 256 ### External Module Compatibility 257 258 If your configuration depends on external modules, newer versions of those 259 modules may include breaking changes. External modules are not part of 260 Terraform and are therefore not subject to these compatibility promises. 261 262 ## Provisioners 263 264 We will maintain compatibility for the `file`, `local-exec`, and `remote-exec` 265 provisioner types through all v1.x releases. 266 267 Some additional vendor-specific provisioners were available in earlier 268 Terraform versions but were deprecated in Terraform v0.13 and removed in 269 Terraform v0.15. 270 271 Terraform supports loading additional provisioners as plugins from certain 272 local filesystem directories. We'll continue to support that throughout the 273 Terraform v1.x releases, but since such plugins are separate from Terraform 274 Core itself their own behaviors cannot be subject to these compatibility 275 promises. However, we will continue to support the plugin wire protocol as 276 defined in Terraform v1.0 throughout the v1.x releases, and so 277 correctly-implemented provisioner plugins should remain compatible with future 278 Terraform releases. 279 280 ## State Storage Backends 281 282 When you use _remote state_, Terraform interacts with remote services over 283 the network in order to store and manage locks for Terraform state. 284 285 For historical reasons, all supported state storage backends are included as 286 part of Terraform CLI but not all are supported directly by the Terraform 287 Team. Only the following backends maintained by the Terraform team are subject 288 to compatibility promises: 289 * `local` (the default, when you are not using remote state) 290 * `http` 291 292 The other state storage backends are maintained by external teams via 293 contributions to the Terraform CLI codebase, and so their expected 294 configuration arguments or behaviors might change even in v1.x releases, 295 although we will aim to still ensure a good migration path in such cases, 296 where possible. 297 298 We are considering allowing external state storage backend implementations 299 via plugins, similar to provider plugins. If we introduce such a mechanism 300 during the v1.x releases then you may need to make configuration changes in 301 order to use those plugins, and state storage backends other than those 302 listed above may be removed from later versions of Terraform CLI once 303 equivalent plugins are available. 304 305 ### The `remote` Backend and Terraform Cloud 306 307 The `remote` backend is maintained by the Terraform Cloud team and so its 308 behavior may change along with ongoing changes to Terraform Cloud. 309 310 There will be a supported mechanism to use Terraform CLI with Terraform Cloud 311 throughout the v1.x releases, but the exact details may change. Terraform Cloud 312 evolves independently of Terraform CLI and is therefore not subject to these 313 compatibility promises. 314 315 ## Community-maintained State Storage Backends 316 317 The `azurerm`, `consul`, `s3`, and `kubernetes` backends are maintained by 318 other teams at HashiCorp. Those teams intend to continue basic maintenence at 319 the level of bug fixes through the v1.x releases, unless we implement a plugin 320 protocol for backends at which point development of these backends is likely 321 to continue in the external plugins only, which may require configuration 322 changes to switch to the plugin equivalents. 323 324 The `cos`, `oss`, `pg`, `gcs`, and `etcdv3` backends are maintained by outside 325 contributors and are not subject to these compatibility promises. 326 327 ### Unmaintained State Storage Backends 328 329 The `artifactory`, `etcdv2`, `manta`, and `swift` state storage backends do not 330 currently have any maintainers and thus remain in Terraform CLI releases on 331 a best-effort basis. They may be removed in later v1.x releases, and will not 332 be updated in case of any breaking changes to the services they integrate with. 333 334 ## Supported Platforms 335 336 Throughout the v1.x series we will continue to produce official releases for 337 the following platforms, and make changes as necessary to support new 338 releases of these operating systems: 339 340 * macOS on x64 CPUs (`darwin_amd64`) 341 * Windows on x64 CPUs (`windows_amd64`) 342 * Linux on x64, 32-bit ARMv6, and 64-bit ARMv8 (`linux_amd64`, `linux_arm`, and `linux_arm64` respectively) 343 344 Over time we may require newer versions of these operating systems. For 345 example, subsequent Terraform releases in the v1.x series might end support 346 for earlier versions of macOS or Windows, or earlier Linux kernel releases. 347 348 We have historically produced official releases for a number of other platforms 349 as a convenience to users of those platforms, and we have no current plans to 350 stop publishing them but we cannot promise ongoing releases or bug fixes for 351 the other platforms throughout the v1.x series. We do not routinely test 352 Terraform on any platforms other than those listed above. 353 354 We might add support for new platforms in later v1.x releases. If so, earlier 355 Terraform releases prior to that support will not be available on those 356 platforms. 357 358 All Terraform plugins, including provider plugins, are separate programs that 359 have their own policies for which platforms they support. We cannot guarantee 360 that all providers currently support or will continue to support the platforms 361 listed above, even though Terraform CLI itself will support them. 362 363 ## Later Revisions to These Promises 364 365 We may extend or refine these promises throughout the v1.x series in order to 366 describe promises related to new features or to clarify existing promises if 367 we find via feedback that our earlier statements had been unclear. 368 369 Promises for new features will be additive in the sense that they will add 370 further promises without retracting any existing ones. For promises that only 371 apply to later v1.x releases we will mention the earliest version(s) those 372 promises apply to. 373 374 Even if we don't add an explicit statement to this document, we intend that 375 any non-experimental features added in later v1.x releases will remain 376 compatible at least through the remainder of the v1.x series, unless otherwise 377 stated. 378 379 ## Appendices 380 381 ### Protected Workflow Commands 382 383 The following is the list of Terraform CLI subcommands and options that are 384 subject to these compatibility promises. If you build automation around 385 these commands then it should be compatible with all later v1.x releases. 386 387 As noted above, compatibility with external software is limited to 388 explicitly-machine-readable output (`-json` and `-raw` modes) and exit codes. 389 Any natural-language output from these commands might change in later releases. 390 391 * [`init`](/docs/cli/commands/init.html) 392 * `-backend=false` 393 * `-backend-config=FILE` 394 * `-backend-config="KEY=VALUE"` 395 * `-force-copy` 396 * `-get=false` 397 * `-input=false` 398 * `-migrate-state` 399 * `-no-color` 400 * `-plugin-dir=DIR` 401 * `-reconfigure` 402 * `-upgrade` 403 * [`validate`](/docs/cli/commands/validate.html) 404 * `-json` 405 * `-no-color` 406 * [`plan`](/docs/cli/commands/plan.html) 407 * `-compact-warnings` 408 * `-destroy` 409 * `-detailed-exitcode` 410 * `-lock=false` 411 * `-lock-timeout=DURATION` 412 * `-input=false` 413 * `-json` 414 * `-no-color` 415 * `-out=FILE` 416 * `-parallelism=N` 417 * `-refresh=false` 418 * `-refresh-only` 419 * `-replace=ADDRESS` 420 * `-target=ADDRESS` 421 * `-var 'NAME=VALUE'` 422 * `-var-file=FILE` 423 * [`apply`](/docs/cli/commands/apply.html) 424 * `-auto-approve` 425 * `-compact-warnings` 426 * `-lock=false` 427 * `-lock-timeout=DURATION` 428 * `-input=false` 429 * `-json` 430 * `-no-color` 431 * `-parallelism=N` 432 * `-refresh=false` 433 * `-refresh-only` 434 * `-replace=ADDRESS` 435 * `-target=ADDRESS` 436 * `-var 'NAME=VALUE'` 437 * `-var-file=FILE` 438 * [`show`](/docs/cli/commands/show.html) 439 * `-no-color` 440 * `-json` 441 * (both with and without a plan file) 442 * [`providers`](/docs/cli/commands/providers.html) (with no subcommand) 443 * [`providers lock`](/docs/cli/commands/providers/lock.html) 444 * `-fs-mirror=PATH` 445 * `-net-mirror=URL` 446 * `-platform=OS_ARCH` 447 * [`providers mirror`](/docs/cli/commands/providers/mirror.html) 448 * `-platform=OS_ARCH` 449 * [`providers schema`](/docs/cli/commands/providers/schema.html) 450 * `-json` 451 * [`fmt`](/docs/cli/commands/fmt.html) 452 * `-list=false` 453 * `-write=false` 454 * `-diff` 455 * `-recursive` 456 * `-check` 457 * [`version`](/docs/cli/commands/version.html) 458 * `-json` 459 * [`output`](/docs/cli/commands/output.html) 460 * `-no-color` 461 * `-json` 462 * `-raw` 463 * [`taint`](/docs/cli/commands/taint.html) 464 * `-allow-missing` 465 * `-lock=false` 466 * `-lock-timeout=DURATION` 467 * `-ignore-remote-version` 468 * [`untaint`](/docs/cli/commands/untaint.html) 469 * `-allow-missing` 470 * `-lock=false` 471 * `-lock-timeout=DURATION` 472 * `-ignore-remote-version` 473 * [`force-unlock`](/docs/cli/commands/force-unlock.html) 474 * `-force` 475 * [`state list`](/docs/cli/commands/state/list.html) 476 * `-id=ID` 477 * [`state pull`](/docs/cli/commands/state/pull.html) 478 * [`state push`](/docs/cli/commands/state/push.html) 479 * `-force` 480 * `-lock=false` 481 * `-lock-timeout=DURATION` 482 * [`state show`](/docs/cli/commands/state/show.html) 483 * `-ignore-remote-version` 484 * [`login`](/docs/cli/commands/login.html) 485 486 For commands or options not in the above list, we will still avoid breaking 487 changes where possible, but can't promise full compatibility throughout the 488 v1.x series. If you are building automation around Terraform, use only the 489 commands above to avoid the need for changes when upgrading. 490 491 Please note that although Terraform's internal logs (via the `TF_LOG` 492 environment variable) are available in a JSON format, the particular syntax 493 or structure of those log lines is _not_ a supported integration interface. 494 The logs are available as JSON only to help with ad-hoc filtering and 495 processing of logs by Terraform developers. 496 497 ### Commands That Might Change 498 499 All of the following commands and their subcommands/options are _not_ subject 500 to compatibility promises, either because we have existing plans to improve 501 them during the v1.x series or because we are aware of shortcomings in their 502 design that might require breaking changes for ongoing maintenence. 503 504 While you can freely use these commands when running Terraform interactively 505 as long as they remain supported, we don't recommend using them as part of 506 any automation unless you are willing to potentially update that automation 507 when upgrading to a later v1.x release. 508 509 * `destroy` (consider `terraform apply -destroy` instead) 510 * `console` 511 * `get` (consider `terraform init` instead) 512 * `graph` 513 * `import` 514 * `push` 515 * `refresh` (consider `terraform apply -refresh-only` instead) 516 * `state mv` 517 * `state replace-provider` 518 * `state rm` 519 * all subcommands of `workspace` (and its deprecated alias `env`) 520 521 While we do intend to retain support for the main use-cases associated with 522 these commands in future releases, we cannot promise to retain the exact 523 command names or options used to meet those use-cases. 524 525 ## How We Will Keep These Promises 526 527 ### Automated Regression Testing 528 529 The Terraform codebase includes various unit and integration tests intended to 530 help us to notice accidental behavior regressions before they ship in a stable 531 version. 532 533 However, Terraform is a relatively complex system with many different features 534 that can interact in interesting ways. In the past we've seen reports of 535 behavior differences that appeared only when combining two or more features in 536 a way we hadn't previously anticipated or written automated tests for. 537 538 In each case we have both implemented a change to resolve the compatibility 539 problem _and_ added one or more integration tests representing the behavior 540 of that combination of features. We intend to continue this approach, so we can 541 improve Terraform's test coverage over time. 542 543 ### Prerelease Versions 544 545 We intend that most accidental changes in behavior covered by these promises 546 will be caught by existing tests. However, we also accept that our test suite 547 can never have perfect coverage of all possible feature interactions or other 548 edge cases, and so we aim for each significant change to be included in both 549 alpha and beta releases before eventual inclusion in a final release. 550 551 For minor releases we will typically also issue at least one release candidate 552 prior to the final release. A release candidate represents that planned 553 development is concluded and that we've fixed any regressions reported based 554 on the alpha and beta releases, and thus the final release that follows should 555 typically match exactly or almost exactly its most recent release candidate. 556 557 ### Regressions in Final Releases 558 559 For more obscure combinations of features it is possible that a regression 560 could be undetected during prerelease the prerelease periods and thus included 561 in a final release. 562 563 If someone finds and reports such a regression soon after its release then we 564 will treat it as a bug and fix it to restore the previous behavior in future 565 releases, unless there is a very significant justification such as a security 566 advisory. In these cases, we'll typically recommend anyone affected by the 567 regression remain on the previous version until the problem is fixed and then 568 skip forward directly to the new release containing that fix. 569 570 You can minimize the risk of being affected by missed regressions in final 571 releases by proactively testing modules against alpha, beta, and release 572 candidate packages. We recommend doing so only in isolated development or 573 staging environments rather than against your production infrastructure. If you 574 find a change in behavior in a prerelease build that seems contrary to the 575 promises in this document, please open an issue in Terraform's GitHub 576 repository to discuss it. 577 578 ### Late-reported Regressions 579 580 In the most extreme case, there may be a regression with a combination of 581 features that is so rare that it remains undetected for a long time. 582 583 After a change has been included in more releases it becomes increasingly 584 likely that other users will have depended on the newer behavior and thus we 585 will need to make a tradeoff to decide whether restoring the behavior would 586 have a greater negative impact than retaining the new behavior. We will always 587 make this decision with due consideration to the implications of each unique 588 situation. 589 590 You can minimize the risk of your modules being affected by late-reported 591 regressions by upgrading promptly to new minor and patch releases of Terraform 592 and reporting any compatibility problems you encounter in Terraform's GitHub 593 repository. 594 595 ### Pragmatic Exceptions 596 597 We are making the promises above in good faith, with the intent that your 598 investment in writing Terraform modules or automation will not be invalidated 599 by future changes to Terraform. However, broad promises like the above can't 600 possibly cover all nuances of practical problems that might arise as we 601 continue to develop Terraform. 602 603 For that reason, there are some situations where we may still need to make 604 changes that may impact existing modules or automation: 605 606 * Security problems: We may become aware of a design problem that has an 607 important security impact. Depending on our determination of the associated 608 risk, we may choose to break compatibility to achieve a more secure system. 609 * External Dependencies: Terraform's behavior depends on interfaces provided 610 by external codebases, including your chosen operating system and including 611 some remote network services for situations such as module and provider 612 installation. These external systems can change outside of our control, 613 including potentially removing or changing features that Terraform's own 614 features depend on. In that case, if there is no suitable replacement 615 mechanism then we may need to change Terraform's design to work within the 616 new constraints. 617 * Opt-in Compatibility Breaks: The design of a language new feature may require 618 changing the behavior or configuration representation of an existing feature. 619 If so, we will typically make the new feature opt-in only in order to avoid 620 breaking existing modules, but if you change your module to opt in to the 621 new feature then you may also then be required to change other parts of your 622 configuration to work with the new language design. 623 * Bugs in New Features: If we introduce a new feature to Terraform and the 624 initial implementation has problems that cause it to not match the documented 625 design intent at release, we may make a follow-up release that corrects 626 the implementation to match the documented design, even if that represents 627 a minor compatibility regression compared to the initial implementation. 628 However, once a feature is well-established and in common use we will usually 629 defer to the implemented behavior and instead change the documentation to 630 reflect it. 631 * Regressions in Existing Features: If we learn that a new Terraform release 632 includes a regression for an existing feature that wasn't detected during 633 the development and prerelease periods, and that learning comes promptly 634 after the new release, we will typically restore the previous behavior at 635 the expense of technically therefore breaking compatibility with the behavior 636 of the new release, under the assumption that more users will have systems 637 affected by the regression than will have systems depending on the 638 newly-introduced behavior. 639 * Late-reported regressions: As described in the previous section, if we 640 learn that there was an unintentional regression of a rarely-used feature or 641 combination of features in a much earlier release then restoring the previous 642 behavior may appear as a regression to later adopters. If we believe that 643 fixing the regression would affect more users than the regression itself 644 affects then we may choose to accept the regression as the new promised 645 behavior. 646 * Situations we cannot anticipate: Although we've made an effort to consider 647 various specific exceptional situations here, Terraform and its development 648 process are not isolated from broader context, and so we must consider that 649 there may be situations that we cannot possibly anticipate that would affect 650 the future of Terraform. In those situations, we will always do our best to 651 find a course of action that will minimize as much as possible the impact to 652 existing modules and automation. 653 654 Our intent with these pragmatic exceptions is only to acknowledge that there 655 will always be situations that general compatibility promises cannot address. 656 We will use these exceptions only with due consideration and as a last resort.