.terraform.lock.hcl is Terraform’s dependency lock file. It records the exact provider selections and checksums that were used in a workspace, making infrastructure runs more predictable and easier to audit. By pinning these values, teams reduce the risk that a new provider release silently changes behavior during terraform init or later deployments.
In cyber security, the lock file matters because it is part of the trust chain. Attackers may try to alter it inside a repository to steer engineers toward malicious or unexpected provider content, or to blend harmful changes into normal infrastructure code review. Defenders use it to verify integrity, compare changes carefully, and detect tampering before code reaches production or a developer workstation.