World map

 

BM

World T4: Modules & Pipelines

Module sources and version pins

You will learn: where modules can come from, and how to pin the version you trust.

Checked with OpenTofu 1.13 on 1 Nov 2026

The problem

Your blueprint uses a stall module from the internet, with no version. Tonight its author changes it. Tomorrow CI runs tofu init and tofu plan. What can happen?

Watch

Tap the two lines that pin a version.

0 of 2 found

A version pin: The versions of a module or provider you trust, like ~> 1.2. Nothing outside the range sneaks in. says which versions you trust. A local folder needs none: it changes only when you change it.

Try it

Where does each module come from?

Drag a card into a box. Or tap the card, then tap the box.

        Predict

        The pin says version = "~> 1.2.0". Which update can arrive by itself?

        Try it

        Now the pin is ~> 1.2. Sort each version.

        Drag a card into a box. Or tap the card, then tap the box.

            Check

            Review a teammate’s modules. Swipe: good, or needs work?

            Swipe right for good, left for needs work. Or use the buttons.

            1 / 4

            A registry module with version = "~> 1.2"

            You did it!

            You can now pick a module source and pin the version you trust.

            Go deeper (optional)

            OpenTofu can also fetch modules from OCI registries (oci://) and from S3, GCS or HTTP. To move to a newer module version, change the pin, then run tofu init -upgrade. The lock file (next lesson) records providers only, not modules.

            Real mission

            3. tofu init

            0 of 3 steps done · Your ticks are saved.