Terraform 1.17.0: Policy GA, Minimal Refresh, and Variables in Provider Requirements

Introduction

Terraform 1.17.0 was released on October 21, 2026, following 1.16.5. This release graduates Terraform Policy to general availability, adds a new -minimal-refresh planning option, and allows variables and locals inside provider requirements blocks. It also ships several bug fixes around numeric functions, ephemeral resource diagnostics, and terraform query. This article covers what matters for day-to-day Terraform usage, with upgrade and verification steps.

What Is New

Variables and locals in provider requirements

Terraform now supports variables and locals in the required_providers block (#39153). This makes it possible to parameterize provider version constraints or source addresses without hardcoding them.

locals {
  aws_provider_version = ">= 5.0.0, < 6.0.0"
}
 
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = local.aws_provider_version
    }
  }
}

-minimal-refresh planning option

A new -minimal-refresh flag limits refresh to resources that have proposed changes, instead of refreshing every resource in state (#35290). This can reduce plan time in large state files.

terraform plan -minimal-refresh

Terraform Policy is generally available

Terraform Policy no longer requires an experimental build or the -allow-experimental-features flag. The -policies flag is now available directly on plan, apply, and query (#38970). Query policies can evaluate resources discovered by list blocks and report results in human-readable or JSON form. See the official docs at https://developer.hashicorp.com/terraform/policy for the policy language and workflow.

terraform plan -policies=./policies
terraform query -policies=./policies

Enhancements

• terraform init log messages now include provider versions, making dependency resolution easier to debug (#38918).
• mock_provider in the testing framework now supports ephemeral resources (#38928).
• terraform login now displays a warning after a successful login if the user is subject to an organization's TTL policy.

Bug fixes worth knowing

• pow and log no longer panic when the result is not a number, and now raise errors instead of returning +/- Infinity, which was previously unusable downstream (#38912, #39304).
• Diagnostics raised while renewing an ephemeral resource are now surfaced instead of being silently dropped. Expect to see new warnings or errors that were previously hidden (#38989).
• terraform query -policies now rejects a path that isn't a directory instead of passing it through to the policy engine (#39238).
• terraform show now reads variable values from the plan file when showing a local plan (#39362).
• Deterministic dependency ordering in the test cleanup graph (#38247).

Notes

• terraform version -json output now includes a format_version field to allow safer future changes to the JSON schema (#38930). Tooling that parses this JSON should ignore unknown fields; consumers of hashicorp/terraform-json or hashicorp/terraform-exec should keep those libraries up to date.
• Terraform is now built with Go 1.26.10, which removes trust for certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#39417). This is relevant if any registry or provider endpoint in your environment relied on those CAs.

No deprecations or breaking changes are called out in this release's changelog.

Upgrade Steps

Pin the new version in your configuration:

terraform {
  required_version = ">= 1.17.0"
}

Then upgrade the CLI and re-initialize working directories:

# macOS (Homebrew)
brew upgrade hashicorp/tap/terraform
 
# Or download directly from releases.hashicorp.com
 
terraform init -upgrade

If using tfenv:

tfenv install 1.17.0
tfenv use 1.17.0

Verify

Confirm the installed version and check the new JSON format_version field:

terraform version
terraform version -json | jq '.format_version, .terraform_version'

If using the new refresh option, confirm the plan honors it:

terraform plan -minimal-refresh

If adopting Terraform Policy, run a query or plan with -policies pointed at a real directory and confirm results are returned without the experimental flag:

terraform plan -policies=./policies -out=tfplan

Conclusion

Terraform 1.17.0 is a feature-forward minor release: Policy reaches GA, -minimal-refresh gives teams a lever to speed up plans on large states, and provider requirements become more dynamic with variables and locals. The bug fixes around pow/log and ephemeral resource diagnostics are worth reviewing if your configurations use those functions or ephemeral resources. Upgrade is low-risk; run terraform init -upgrade and re-run your existing plan/apply pipeline to confirm no new diagnostics surface from the ephemeral renewal fix.