Module Sources, Versions, and the Public Registry

1. 1

   Tag the current modules

   In a monorepo, prefix tags with the module name so each module versions independently. Push the tags; git sources can only reference what's on the remote.

   terminalcopy cmd

   $ git tag network-v1.0.0 && git tag ecs-service-v1.0.0

   git push origin network-v1.0.0 ecs-service-v1.0.0

   ── expected output ──

   * [new tag] network-v1.0.0 -> network-v1.0.0

   * [new tag] ecs-service-v1.0.0 -> ecs-service-v1.0.0

2. 2

   Consume by tag

   Swap the local paths for pinned git sources. The module code is identical, so after terraform init the plan has no changes, but now editing modules/ on disk no longer changes what dev deploys until you bump ref.

   Same for module.api and module.worker with ecs-service-v1.0.0.

   module "network" {
     source = "git::https://github.com/you/shoplite.git//modules/network?ref=network-v1.0.0"
     # ...inputs unchanged
   }

   terminalcopy cmd

   $ terraform init && terraform plan

   ── expected output ──

   Initializing modules...

   Downloading git::https://github.com/you/shoplite.git?ref=network-v1.0.0 for network...

   - network in .terraform/modules/network/modules/network

   ...

   No changes. Your infrastructure matches the configuration.

3. 3

   See what's installed

   modules.json records every module call, its source, and where it was downloaded. When someone asks 'which version is prod on?', this and the ref in code answer it.

   terminalcopy cmd

   $ jq '.Modules[] | {Key, Source}' .terraform/modules/modules.json

   ── expected output ──

   { "Key": "", "Source": "" }

   { "Key": "api", "Source": "git::https://github.com/you/shoplite.git//modules/ecs-service?ref=ecs-service-v1.0.0" }

   { "Key": "network", "Source": "git::https://github.com/you/shoplite.git//modules/network?ref=network-v1.0.0" }

   { "Key": "worker", "Source": "git::https://github.com/you/shoplite.git//modules/ecs-service?ref=ecs-service-v1.0.0" }

4. 4

   Evaluate the community VPC module (plan only)

   In a scratch folder with a LOCAL backend (never touching ShopLite's state), configure terraform-aws-modules/vpc/aws to match your design and plan. Compare the resource count and read its variables. It does more than yours (flow logs, IPv6, NACLs, and many more options), and that's both the appeal and the cost.

   provider "aws" {
     region = "ap-south-1"
   }
   
   module "vpc" {
     source  = "terraform-aws-modules/vpc/aws"
     version = "~> 6.0"
   
     name             = "registry-compare"
     cidr             = "10.99.0.0/16"
     azs              = ["ap-south-1a", "ap-south-1b"]
     public_subnets   = ["10.99.0.0/24", "10.99.1.0/24"]
     private_subnets  = ["10.99.10.0/24", "10.99.11.0/24"]
     database_subnets = ["10.99.20.0/24", "10.99.21.0/24"]
   
     enable_nat_gateway = true
     single_nat_gateway = true
   }

   terminalcopy cmd

   $ cd ../scratch/registry-vpc && terraform init && terraform plan | tail -n 1

   ── expected output ──

   Downloading registry.terraform.io/terraform-aws-modules/vpc/aws 6.x.x for vpc...

   ...

   Plan: 23 to add, 0 to change, 0 to destroy.

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.