Question

Your platform team maintains a set of reusable Terraform modules (networking, IAM, GKE) consumed by dozens of application teams across the organization. Teams currently reference the modules directly from the main branch of a shared Git repository. Recently, an unreviewed change to the networking module broke several teams' pipelines simultaneously. You need to design an infrastructure-as-code architecture that lets application teams adopt module changes on their own schedule while ensuring they consume only tested, immutable module versions. What should you do?

Accepted Answer

Publish the modules to a private Artifact Registry (or a version-tagged Git source) and require teams to pin each module reference to a specific semantic version tag, promoting new versions only after CI validation.

Answer

Have each application team fork the shared module repository into their own project and maintain independent copies of every module.

Answer

Add a branch protection rule requiring two approvals on the main branch so that all teams continue consuming modules from main.

Answer

Move all module code directly into each application team's root Terraform configuration to eliminate the shared dependency entirely.