You add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The existing and new resources use the same provider. The working contains a .terraform.lock, hc1 file.
How will Terraform choose which version of the provider to use?
In a Terraform Cloud workpace linked to a version control repository speculative plan rum start automatically commit changes to version control.
It is best practice to store secret data in the same version control repository as your Terraform configuration.