Terraform Tutorial — Configuring the AWS Provider

1 minute read

The AWS provider is the most popular Terraform provider. This page covers how to configure it for authentication, region selection, and default tags.

Minimal Configuration

The simplest AWS provider configuration specifies only the region:

provider "aws" {
  region = "us-east-1"
}

Terraform uses your local AWS credentials (from ~/.aws/credentials or environment variables) automatically. You rarely need to specify credentials in the provider block.

Full Configuration

provider "aws" {
  region  = "us-east-1"
  profile = "my-profile"    # Named profile from ~/.aws/credentials

  default_tags {
    tags = {
      ManagedBy   = "terraform"
      Project     = "web-app"
      Environment = var.environment
    }
  }
}

Common Arguments

Argument Purpose
region AWS region for all resources
profile Named profile from ~/.aws/credentials
access_key / secret_key Static credentials (avoid — use profiles or env vars)
assume_role {} Assume an IAM role before making API calls
default_tags {} Tags applied to every resource automatically

Default Tags

Default tags are applied to every AWS resource that supports tagging. This saves you from repeating the same tags on every resource:

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = {
      ManagedBy = "terraform"
      Project   = var.project_name
    }
  }
}

# These tags are automatically added to every resource:
resource "aws_s3_bucket" "example" {
  bucket = "my-bucket"
  # No need to specify ManagedBy or Project tags — they're inherited
}

Authentication Priority

The AWS provider checks credentials in this order:

  1. access_key and secret_key in the provider block (not recommended)
  2. Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
  3. Shared credentials file: ~/.aws/credentials
  4. EC2 Instance Metadata (IAM role)
  5. ECS task role

💡 Tip: For local development, use ~/.aws/credentials. For CI/CD, use environment variables or IAM roles. Never hardcode credentials in .tf files.

Assume Role

To create resources in a different AWS account, use assume_role:

provider "aws" {
  region = "us-east-1"

  assume_role {
    role_arn     = "arn:aws:iam::987654321098:role/TerraformRole"
    session_name = "terraform-session"
  }
}

This is common in multi-account AWS organizations where Terraform runs in a central account and assumes roles in target accounts.

What’s Next?

You’ve configured a single AWS provider. But what if you need resources in two different regions? That’s where provider aliases come in.

← Provider Versioning Multiple Providers & Aliases →

You may also enjoy