How to fix Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found in Terraform

The fastest way to provide credentials is to set environment variables:

export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export AWS_DEFAULT_REGION="us-east-1"

Verify credentials are set:

echo $AWS_ACCESS_KEY_ID
echo $AWS_SECRET_ACCESS_KEY

Then run Terraform:

terraform init
terraform plan

Note: On Windows, use set instead of export.

If you have not already done so, configure the AWS CLI:

aws configure

You will be prompted for:
- AWS Access Key ID
- AWS Secret Access Key
- Default region
- Default output format

This creates or updates ~/.aws/credentials and ~/.aws/config.

Terraform will automatically find these credentials. Verify by running:

terraform init

To use a specific named profile, add to your Terraform provider:

provider "aws" {
  region  = "us-east-1"
  profile = "default"
}

If running Terraform from an EC2 instance, attach an IAM role to the instance:

1. Create an IAM role with appropriate permissions (e.g., AdministratorAccess for testing)
2. Attach the role to your EC2 instance via the AWS Console or CLI
3. Do NOT set AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY environment variables
4. Terraform will automatically use the EC2 instance metadata service to retrieve temporary credentials

Verify the instance has the role:

aws sts get-caller-identity

If successful, Terraform should work without explicit credentials:

terraform init
terraform plan

This is the recommended approach for CI/CD runners on AWS infrastructure.

In AWS Provider version 4.0 and later, if you explicitly set a profile in the provider configuration, it will NOT fall back to environment variables if that profile is not found or invalid.

If you have this in your code:

provider "aws" {
  region  = "us-east-1"
  profile = "nonexistent-profile"
}

Verify the profile exists in your ~/.aws/credentials file:

cat ~/.aws/credentials

You should see a section like:

[nonexistent-profile]
aws_access_key_id = ...
aws_secret_access_key = ...

If the profile does not exist, either:
- Add it to your credentials file with aws configure --profile nonexistent-profile
- Remove the profile line from your Terraform provider to use the default profile
- Set environment variables explicitly (which will be ignored if profile is set)

On Unix-like systems, the ~/.aws/credentials file must have correct permissions:

chmod 600 ~/.aws/credentials
chmod 700 ~/.aws

Verify permissions:

ls -la ~/.aws/credentials

Output should show:

-rw------- 1 user user ... ~/.aws/credentials

If permissions are too open or too restrictive, AWS SDK may not be able to read the file.

For testing purposes, you can hardcode credentials in your provider block:

provider "aws" {
  region     = "us-east-1"
  access_key = "YOUR_ACCESS_KEY"
  secret_key = "YOUR_SECRET_KEY"
}

WARNING: This is NOT recommended for production. If this file is committed to version control, your credentials will be exposed.

Better approach: Use variables with a .tfvars file:

variable "aws_access_key" {
  type      = string
  sensitive = true
}

variable "aws_secret_key" {
  type      = string
  sensitive = true
}

provider "aws" {
  region     = "us-east-1"
  access_key = var.aws_access_key
  secret_key = var.aws_secret_key
}

Create terraform.tfvars (do not commit this file):

aws_access_key = "YOUR_ACCESS_KEY"
aws_secret_key = "YOUR_SECRET_KEY"

Add .tfvars files to .gitignore.