Most engineers assume Terraform behaves deterministically as long as the code does not change.
That assumption breaks at the module layer.
A module version defines the exact behavior Terraform will execute.
Without a fixed version, Terraform resolves whatever matches your constraint at initialization time.
That means the same configuration can produce different infrastructure over time.
The risk becomes real when using version ranges.
A simple terraform init -upgrade can silently introduce a newer module release.
The root configuration looks identical.
The dependency underneath has already changed.
Provider versions are locked.
Module versions are not.
That gap is where drift enters.
This lesson isolates that boundary so your infrastructure behavior remains predictable.