Infrastructure as Code has become the standard practice for provisioning and managing AWS at scale. Terraform provides a declarative language and plugin architecture that lets teams define cloud resources in configuration files and enforce desired state through plan and apply cycles. The Terraform AWS provider is the core plugin that connects Terraform to the Amazon Web Services API surface, while the Terraform AWS Cloud Control Provider is a newer option that maps Terraform to AWS services via the Cloud Control API for faster feature adoption.
Introduction
Terraform providers are plugins that enable communication with external APIs and services. They let Terraform interact with various cloud platforms, infrastructure providers, and third-party services. Providers are specified in the Terraform configuration, allowing users to define the specific services and resources they need to manage and provision.
The Terraform AWS provider is a plugin that enables seamless integration between Terraform and the Amazon Web Services cloud platform. It allows users to define, provision, and manage AWS resources using Terraform’s declarative configuration language. Before using this provider, you must configure it with the appropriate credentials to authenticate and authorize access to your AWS account.
What is a Terraform Provider
In Terraform, a provider is a plugin that interacts with cloud providers, third-party tools, and other APIs. To use Terraform with AWS, you use the AWS Provider.
This distinction adds an extra layer of complexity to Terraform that doesn't exist with CloudFormation. However, that complexity provides increased flexibility. You can declare multiple providers within a single Terraform module, and then the underlying resources that are created can interact with each other as part of the same deployment layer.
This can be useful in numerous ways. Providers don’t necessarily have to be for separate cloud providers. Providers can represent any source for cloud resources. For example, take Amazon Elastic Kubernetes Service. When you provision an Amazon EKS cluster, you might want to use Helm charts to manage third-party extensions and use Kubernetes itself to manage pod resources.
A provider in Terraform is a plugin that enables communication with external APIs and services. It lets Terraform interact with various cloud platforms, such as AWS, infrastructure providers, and other third-party services.
The Terraform AWS Provider Core
The Terraform AWS provider is the plugin Terraform uses to talk to AWS APIs so your configuration can create, update, and read AWS resources like VPCs, IAM roles, S3 buckets, and EC2 instances. You configure it in a provider "aws" block, region plus credentials via env vars, profiles, or assumed roles, then reference its resources and data sources in your code.
Key features of the Terraform AWS provider include:
- Resource management – create/modify/delete AWS resources based on your Terraform configuration, such as EC2 instances, VPCs, load balancers, S3 buckets, and others
- Data sources – get information about existing AWS resources
- State management with S3 and Dynamo DB – you can use AWS for remote state management using S3 to host the state and Dynamo DB for locking
- Great modules community – Because AWS is the leader cloud provider, it also has the biggest modules community
The provider enables resource management for virtually any AWS service. The platform supports over 200 fully featured services and AWS continues to innovate with rapid releases. The Terraform AWS provider is the primary integration point for IaC workflows that target those services.
AWS Cloud Control Provider and Fast Feature Adoption
Today, AWS announced the general availability of the Terraform AWS Cloud Control Provider, enabling customers to take advantage of AWS innovations faster. AWS has been continually expanding its services to support virtually any cloud workload; supporting over 200 fully featured services and delighting customers through its rapid pace of innovation with over 3,400 significant new features in 2023.
Our customers use Infrastructure as Code tools such as HashiCorp Terraform among others as a best-practice to provision and manage these AWS features and services as part of their cloud infrastructure at scale. With the Terraform AWS CC Provider launch, AWS customers using Terraform as their IaC tool can now benefit from faster time-to-market by building cloud infrastructure with the latest AWS innovations that are typically available on the Terraform AWS CC Provider on the day of launch.
For example, AWS customer Meta’s Oculus Studios was able to quickly leverage Amazon GameLift to support their game development.
The Cloud Control Provider maps Terraform resources to the AWS Cloud Control API, which provides a standardized way to interact with AWS services. This approach reduces the lag between an AWS feature launch and its availability in Terraform, because the Cloud Control API is a stable, service-wide interface.
Terraform AWS Provider vs AWS Cloud Control Provider
| Capability | Terraform AWS Provider | Terraform AWS Cloud Control Provider |
|---|---|---|
| API surface | Direct AWS service APIs | AWS Cloud Control API |
| Feature availability | Depends on provider update cycle | Typically available on day of launch |
| Resource coverage | Deep, mature resource set | Broad, standard resource model |
| Use case | Production workloads needing fine-grained control | Fast adoption of new AWS innovations |
Setting Up the Terraform AWS Provider
The process for using the Terraform AWS provider is the following:
- Provider configuration
- AWS resource configuration
- Initializing Terraform to install the provider
- Running Terraform apply to create the resources
Provider Configuration
You can configure your AWS provider in many ways.
Because Terraform can read information from your environment if you have set up your AWS credentials, you could configure the provider just by specifying the region:
hcl
provider "aws" {
region = "eu-west-1"
}
If we don’t specify a Terraform block with a version constraint for the provider, Terraform will automatically download the latest available version of the AWS provider.
At the time of writing, the latest version of the AWS provider is 5.51.1. Let’s add a Terraform block that pins to a specific version:
hcl
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.50.0"
}
}
}
Define AWS Resources
Based on the provider above, we can configure AWS resources. For this example, we will just configure an AWS VPC:
hcl
resource "aws_vpc" "this" {
cidr_block = "10.0.0.0/16"
}
You can configure as many resources as you want.
After writing configuration, initialization installs the provider:
bash
terraform init
Then apply creates the resources:
bash
terraform apply
Output example:
Resources: 1 added, 0 changed, 0 destroyed.
Configuration Options and Authentication
What are the Terraform AWS provider configuration options?
The most important Terraform AWS provider options include:
- region – specify the AWS region in which we want to create your resources
- access_key – the AWS access key we use for authenticating to the provider
- secret_key – the AWS secret key associated with our access key
- assume_role – configuration block for specifying what role we want to use to authenticate with AWS
- token – session token for temporary credentials
You can look here for all the options you can configure for your AWS provider.
Authentication Methods
How to authenticate to AWS with Terraform. There are many ways to authenticate using the Terraform AWS provider.
Terraform can read credentials from environment variables, shared credentials files, EC2 instance metadata, or assume an IAM role. The provider configuration can reference an assume_role block to assume IAM roles with the Terraform AWS provider.
Typical configuration patterns:
hcl
provider "aws" {
region = "us-east-1"
access_key = var.aws_access_key
secret_key = var.aws_secret_key
}
hcl
provider "aws" {
region = "us-east-1"
assume_role {
role_arn = "arn:aws:iam::123456789012:role/TerraformRole"
}
}
Advanced Concepts and Workflows
In this article, we will give an overview of what the AWS provider is in Terraform and show everything from basic concepts to advanced configuration and authentication methods for managing AWS resources using Terraform.
What we will cover:
- What is a Terraform provider?
- What is the Terraform AWS provider?
- How to set up the Terraform AWS provider?
- Terraform AWS provider configuration options
- Authenticating to AWS with Terraform
- Assuming IAM roles with the Terraform AWS provider
- How to upgrade the Terraform AWS provider to the newest version?
- Terraform AWS provider – Common issues and troubleshooting
TL;DR
The Terraform AWS provider is the plugin Terraform uses to talk to AWS APIs so your configuration can create, update, and read AWS resources like VPCs, IAM roles, S3 buckets, and EC2 instances. You configure it in a provider "aws" block, region plus credentials via env vars, profiles, or assumed roles, then reference its resources and data sources in your code.
Provider Version Management
Terraform providers are versioned and managed through the required_providers block. Pinning a version gives reproducibility. Upgrading the Terraform AWS provider to the newest version involves updating the version constraint and running terraform init -upgrade.
State Management
State management with S3 and Dynamo DB is a common pattern. You can use AWS for remote state management using S3 to host the state and Dynamo DB for locking. This enables team collaboration and safe concurrent applies.
Multi-Provider Modules
Providers don’t necessarily have to be for separate cloud providers. Providers can represent any source for cloud resources. When you provision an Amazon EKS cluster, you might want to use Helm charts to manage third-party extensions and use Kubernetes itself to manage pod resources.
Declaring multiple providers within a single Terraform module allows resources created by different providers to interact as part of the same deployment layer. This adds flexibility beyond CloudFormation’s single-service model.
Configuration Options Reference
| Option | Purpose |
|---|---|
| region | AWS region for resource creation |
| access_key | AWS access key for authentication |
| secret_key | AWS secret key associated with access key |
| assume_role | Block to assume an IAM role for authentication |
| token | Session token for temporary credentials |
Conclusion
The Terraform AWS provider remains the central plugin for declarative AWS infrastructure management, offering mature resource coverage, data sources, and community modules built around over 200 fully featured AWS services. Its configuration model centers on a provider "aws" block with region and credential options, support for assume_role and token-based authentication, and the ability to manage state remotely with S3 and DynamoDB.
The introduction of the Terraform AWS Cloud Control Provider complements the existing provider by providing a standardized path to adopt new AWS features on the day of launch. AWS delivered over 3,400 significant new features in 2023, and the Cloud Control Provider reduces time-to-market for customers who rely on Terraform as their IaC tool. Real-world adoption, such as Meta’s Oculus Studios leveraging Amazon GameLift quickly, demonstrates the practical value of faster feature availability.
Choosing between the traditional Terraform AWS provider and the Cloud Control Provider depends on workload needs: deep, fine-grained control and mature resources versus rapid adoption of new services. In practice, teams often use both, leveraging the classic provider for production-critical resources and the Cloud Control Provider for early access to emerging AWS capabilities.