Terraform 1.17 RC2: Variables in required_providers and Faster Plans

Terraform 1.17.0-RC2 landed October 14 with a go-live support license and three features worth upgrading for: variables and locals are now valid inside required_providers blocks, a new -minimal-refresh flag cuts plan time on large stacks, and Terraform Policy graduates to GA — meaning built-in policy-as-code with no HCP subscription required.

Variables in required_providers: The End of a Long Workaround Era

Before 1.17, every version constraint in required_providers had to be a static string literal. If you wanted environment-specific provider pins or wanted to centralize version constraints across dozens of modules, your options were Terragrunt generate blocks, pre-init sed substitutions in CI, or just copy-pasting version strings and hoping someone updated them everywhere.

1.17 removes that constraint. Variables and locals are now valid inside required_providers:

# Before (Terraform 1.16 and earlier)
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # had to be a literal
    }
  }
}

# After (Terraform 1.17+)
locals {
  aws_version = var.env == "prod" ? "= 5.80.0" : "~> 5.0"
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = local.aws_version
    }
  }
}

Production locks to a specific patch. Dev tracks the minor range. No wrapper scripts, no envsubst, no Terragrunt just to manage a version string. Module authors can now accept a provider_version variable from parent modules and enforce it down the tree — which matters in large organizations running 50+ modules against a shared provider set.

One important clarification: values still must be known at plan time. This is design-time flexibility, not runtime dynamism. You cannot reference resource attributes or data source outputs here. But for the practical cases — environment-based pins, centralized version locals, module-tree consistency — this is exactly what the community has been asking for.

-minimal-refresh: Fix Your CI/CD Plans

By default, terraform plan refreshes the state of every resource before calculating a diff. On a stack with 200 resources, that means 200 API calls to your cloud provider. AWS rate limits being what they are, a full refresh on large infrastructure can take minutes — which makes plan-on-every-PR a painful experience.

The new -minimal-refresh flag inverts this logic:

terraform plan -minimal-refresh -out=tfplan

Terraform runs an initial plan without refreshing, identifies which resources have proposed changes, refreshes only those, and re-plans. If you’re changing 10 resources out of 200, only those 10 generate provider API calls. Each resource instance decides independently — no cascading refreshes from dependencies.

The tradeoff is real: resources that don’t change won’t have their state verified against live infrastructure. Drift introduced outside Terraform — someone modifying an S3 policy in the console — won’t surface on a -minimal-refresh run unless you also touch that resource in your config. The right approach: use -minimal-refresh in PR-triggered CI plans where speed matters; keep full-refresh plans in scheduled drift-detection pipelines.

Terraform Policy Is Now GA — and It Beats OPA Where It Counts

Terraform Policy has been in experimental status since 2025. With 1.17, the -policies flag on plan, apply, and query no longer requires -allow-experimental-features. Policy-as-code is now something the Terraform CLI does rather than something you pay for.

Policies are written in .policy.hcl files using standard HCL — no Rego, no Sentinel DSL:

terraform plan -policies=./policies -out=tfplan
terraform apply -policies=./policies tfplan

The feature that makes Terraform Policy worth watching isn’t the free price tag — it’s apply-time visibility. OPA and Conftest evaluate the plan JSON, which is generated before apply runs. Provider-computed values — ARNs, dynamically assigned ports, generated resource names — don’t exist in the plan. Terraform Policy evaluates at three stages: setup, plan, and apply. That means you can write a policy that checks an actual computed value, not a placeholder. This is structurally impossible with OPA.

One caveat: Terraform Policy does not work with OpenTofu. If your organization has migrated to the CNCF fork, OPA/Conftest remains your path.

Should You Upgrade Now?

RC2 ships with a go-live support license — HashiCorp’s signal that this is production-safe. GA is expected in November 2026. For non-critical environments, there’s no reason to wait. The variables-in-required_providers change is purely additive; existing configs work without modification. The -minimal-refresh flag is opt-in. Terraform Policy is opt-in.

If you have CI pipelines suffering under slow plans on large stacks, -minimal-refresh alone justifies testing RC2 this week. Grab the release from the GitHub releases page, run it against your staging environment, and check the updated provider requirements docs to see the new syntax in full.