Versions
The AWS Baseline, release 1.0.0, pins every tool, provider, registry module and GitHub Action to an exact version: OpenTofu 1.12.6, Terragrunt 1.1.5 and the AWS provider ~> 6.65. The same versions run on engineers' machines and in CI, so a plan means the same thing everywhere.
Where the pins live
root.hcl is the only place OpenTofu and the AWS provider are pinned. It writes the provider requirements into every unit Terragrunt generates. A module carries its own version file only when it needs provider aliases, and then repeats the same pins; a guard script checks this in pre-commit and CI. Registry modules are pinned to an exact version in the unit definition or the module that uses them, and every GitHub Action is pinned to a commit SHA with its version in a trailing comment.
Tools and providers
| Component | Version | Where it is pinned |
|---|---|---|
| OpenTofu | 1.12.6 | root.hcl constraint >= 1.12.6, < 2.0.0; exact version in every workflow |
| Terragrunt | 1.1.5 | root.hcl constraint >= 1.1.5; exact version in every workflow |
| AWS provider | ~> 6.65 | Generated by root.hcl into every unit |
| tflint | v0.64.0 | The plan workflow |
| tflint AWS ruleset | 0.48.0 | .tflint.hcl |
Registry modules
| Module | Version | Used for |
|---|---|---|
terraform-aws-modules/vpc/aws | 6.7.3 | Hub, spoke and runner VPCs; the S3 gateway endpoints through its endpoints submodule |
terraform-aws-modules/transit-gateway/aws | 3.3.1 | The Transit Gateway |
terraform-aws-modules/ecr/aws | 3.2.1 | Container registries in core-artifacts |
terraform-aws-modules/s3-bucket/aws | 5.16.1 | Shared artifact buckets |
github-aws-runners/github-runner/aws | 7.11.0 | Optional self-hosted runners in core-auto |
Every other module in the Baseline is custom and lives in the repository. The design decisions record each registry pin as the latest release as of 2026-09-19.
GitHub Actions
| Action | Version | Workflows |
|---|---|---|
actions/checkout | v7.0.1 | Plan, apply, drift detection |
aws-actions/configure-aws-credentials | v6.3.0 | Plan, apply, drift detection |
opentofu/setup-opentofu | v2.0.2 | Plan, apply, drift detection |
gruntwork-io/terragrunt-action | v3.4.1 | Plan, apply, drift detection |
actions/upload-artifact | v7.0.1 | Plan, apply (run reports) |
actions/github-script | v9.0.0 | Plan (PR comment), drift detection (issue) |
terraform-linters/setup-tflint | v6.3.1 | Plan |
bridgecrewio/checkov-action | v12.3125.0 | Plan |
aquasecurity/trivy-action | v0.36.0 | Plan |
infracost/actions/setup | v4.2.0 | Plan (installs the Infracost CLI) |
infracost/actions/comment | v4.2.0 | Plan (posts the cost comment) |
Each is referenced by full commit SHA, so a moved tag cannot run different code.
Pre-commit hooks
| Hook repository | Revision |
|---|---|
pre-commit/pre-commit-hooks | v6.0.0 |
tofuutils/pre-commit-opentofu | v2.4.2 |
antonbabenko/pre-commit-terraform | v1.109.1 |
bridgecrewio/checkov | 3.3.19 |
The repository's own guard scripts run as local hooks beside these.
How versions change
A version upgrade is its own change, reviewed as a plan before it merges; a provider upgrade changes root.hcl and every module version file that repeats the pin in the same change. The policy and the risk level per kind of change are on the versioning policy page. The versions across all BuiltForProd AWS repositories, including the blueprints, are listed in the release notes, and the concepts behind the two tools are in OpenTofu and Terraform and Terragrunt units and stacks.