A module block uses source = "git::https://example.com/org/network.git" with version = "1.2.0", and terraform init rejects the configuration. The team wants to pin the module to the repository's v1.2.0 tag. Which change is correct?
Select an answer to reveal the explanation.
Short Explanation
The version argument only speaks 'registry'. Hand it a git URL and it has no idea what you mean. For git you put the tag right in the address with ?ref=, like writing the edition number on the library slip itself.
Full Explanation
Terraform's module version argument applies only when the source points to a module registry, such as the public Terraform Registry or the HCP Terraform private registry, because only a registry exposes a list of published versions that Terraform can match against a constraint. Git and other generic sources have no such protocol, so Terraform rejects version there. To pin a git-sourced module, the revision goes into the source address with the ref query parameter, which accepts anything git checkout accepts, such as a tag, a branch or a commit SHA; for example ?ref=v1.2.0. Rewriting the constraint as an exact equality does not help, since the argument itself is invalid for the source type. init -upgrade updates modules and providers within allowed constraints but does not make version legal for git. The dependency lock file records provider selections only, never module sources or commits. Exam caveat: a tag can be moved in some repositories, so a commit SHA in ref gives the strongest immutability for a git module. Operational check: run terraform init and confirm the module installation output shows the git address with the expected ref, then confirm the checkout under .terraform/modules matches that tag.