Terraform lock files pin provider checksums but do not guarantee provider safety

The article explains that a Terraform dependency lock file records selected provider versions and package checksums, enabling reproducible infrastructure automation. Terraform checks downloaded provider packages against these recorded checksums during initialization, which also allows mirrors to be verified against origin-registry checksums. The author stresses that checksums only verify package bytes and do not establish a provider's trustworthiness, least-privilege behavior, or that an approved plan matches the configuration's intent. Recommended practices include generating lock files in controlled environments, failing pipelines when initialization modifies the committed lock file, and treating module and provider upgrades as reviewable code changes. Provider plugins run with the Terraform process's authority, so the article also advises restricting credentials and execution environments.