When you load a Terraform module from Git, you are not just importing code.
You are introducing a moving boundary into your infrastructure.
Terraform does not execute modules directly from Git.
It installs them during terraform init.
That means your infrastructure depends on whatever code exists at that Git reference at the time of initialization.
If you do not pin the ref, Terraform defaults to the repository’s active branch.
Branches move.
Your infrastructure changes without your code changing.
That is the failure point most engineers do not see.
The fix is simple.
Pin the module to a specific tag or commit SHA.
This converts a moving dependency into a fixed boundary.
Once you understand this, Git modules stop being a convenience feature.
They become a controlled distribution mechanism for infrastructure logic.
This lesson breaks down exactly how that mechanism works.