Terraform Tutorial — Credential Errors

1 minute read

Credential errors are the most common issues when starting with Terraform. Here’s how to diagnose and fix them.

Error: No Valid Credential Sources Found

Error: No valid credential sources found

  Please see https://registry.terraform.io/providers/hashicorp/aws
  for more information about providing credentials.

Cause: Terraform can’t find AWS credentials.

Fix: Configure credentials using one of these methods:

# Option 1: AWS CLI configured
$ aws configure
AWS Access Key ID: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name: us-east-1

# Option 2: Environment variables
$ export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
$ export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

# Option 3: AWS profile
$ export AWS_PROFILE="my-profile"

Error: Access Denied

Error: error creating S3 Bucket: AccessDenied: Access Denied
  status code: 403

Cause: Your credentials don’t have permission for the operation.

Fix:

  1. Check which identity is being used:
$ aws sts get-caller-identity
{
    "UserId": "AIDAEXAMPLE123",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/developer"
}
  1. Verify the IAM user/role has the required permissions
  2. Check for restrictive SCPs (Service Control Policies)

Error: Expired Token

Error: error configuring Terraform AWS Provider: ExpiredToken

Cause: Temporary credentials (SSO, assumed role) have expired.

Fix:

# Re-authenticate with SSO
$ aws sso login --profile my-sso-profile

# Or refresh session token
$ aws sts get-session-token

Error: Region Not Configured

Error: error configuring Terraform AWS Provider: no region was found

Cause: No region specified in the provider or environment.

Fix:

provider "aws" {
  region = "us-east-1"
}

Or:

$ export AWS_REGION="us-east-1"

Credential Check Checklist

Check Command
Which identity? aws sts get-caller-identity
Credentials configured? aws configure list
Can access AWS? aws s3 ls
Correct profile? echo $AWS_PROFILE
Region set? echo $AWS_REGION

What’s Next?

Let’s tackle provider-related errors.

← Troubleshooting Hub Provider Errors →

You may also enjoy