How to fix Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 143 views

Terraform cannot find valid AWS credentials to authenticate with the AWS Provider. This occurs when credentials are not configured via environment variables, AWS CLI credentials file, IAM roles, or provider settings.

Quick fix

Fixes Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found

export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export AWS_DEFAULT_REGION="us-east-1"
  1. Set AWS credentials via environment variables
  2. Configure AWS CLI credentials file
  3. Use IAM role if running on EC2
  4. Ensure provider profile config matches credentials file (AWS Provider v4.0+)
terraform — error
export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export AWS_DEFAULT_REGION="us-east-1"
Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found

What this error means

This error indicates that Terraform has attempted to authenticate with AWS but could not locate any valid credentials through any of its supported authentication methods. The AWS Provider checks multiple credential sources in a specific order, and if none are found or all are invalid, Terraform raises this error. This is a critical blocker that prevents Terraform from communicating with AWS to plan or apply infrastructure changes.

Typical symptoms

  • Terraform init or plan commands fail with 'no valid credential sources' error
  • Error appears when running terraform init, terraform plan, or terraform apply
  • Works locally but fails in CI/CD pipelines
  • Works with AWS CLI but not with Terraform
  • Error occurs even after recent AWS credential changes

Common causes

  1. AWS credentials are not set in any supported location (environment variables, credentials file, IAM role, provider config)
  2. AWS access key ID and secret access key environment variables are missing or unset
  3. AWS credentials file (~/.aws/credentials) does not exist or is not readable
  4. AWS CLI has not been configured (run 'aws configure')
  5. Running Terraform outside an EC2 instance without providing credentials explicitly
  6. Using a named profile in Terraform provider config that does not exist in credentials file
  7. IAM role attached to EC2 instance does not have permissions or is not properly associated
  8. Credentials have expired or been revoked without being refreshed
  9. Explicit provider profile configuration takes precedence over environment variables (AWS Provider v4.0+)

How to fix "Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found"

1Set AWS credentials via environment variables

The fastest way to provide credentials is to set environment variables:

bash
export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export AWS_DEFAULT_REGION="us-east-1"

Verify credentials are set:

bash
echo $AWS_ACCESS_KEY_ID
echo $AWS_SECRET_ACCESS_KEY

Then run Terraform:

bash
terraform init
terraform plan

Note: On Windows, use set instead of export.

2Configure AWS CLI credentials file

If you have not already done so, configure the AWS CLI:

bash
aws configure

You will be prompted for:
- AWS Access Key ID
- AWS Secret Access Key
- Default region
- Default output format

This creates or updates ~/.aws/credentials and ~/.aws/config.

Terraform will automatically find these credentials. Verify by running:

bash
terraform init

To use a specific named profile, add to your Terraform provider:

hcl
provider "aws" {
  region  = "us-east-1"
  profile = "default"
}
3Use IAM role if running on EC2

If running Terraform from an EC2 instance, attach an IAM role to the instance:

1. Create an IAM role with appropriate permissions (e.g., AdministratorAccess for testing)
2. Attach the role to your EC2 instance via the AWS Console or CLI
3. Do NOT set AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY environment variables
4. Terraform will automatically use the EC2 instance metadata service to retrieve temporary credentials

Verify the instance has the role:

bash
aws sts get-caller-identity

If successful, Terraform should work without explicit credentials:

bash
terraform init
terraform plan

This is the recommended approach for CI/CD runners on AWS infrastructure.

4Ensure provider profile config matches credentials file (AWS Provider v4.0+)

In AWS Provider version 4.0 and later, if you explicitly set a profile in the provider configuration, it will NOT fall back to environment variables if that profile is not found or invalid.

If you have this in your code:

hcl
provider "aws" {
  region  = "us-east-1"
  profile = "nonexistent-profile"
}

Verify the profile exists in your ~/.aws/credentials file:

bash
cat ~/.aws/credentials

You should see a section like:

bash
[nonexistent-profile]
aws_access_key_id = ...
aws_secret_access_key = ...

If the profile does not exist, either:
- Add it to your credentials file with aws configure --profile nonexistent-profile
- Remove the profile line from your Terraform provider to use the default profile
- Set environment variables explicitly (which will be ignored if profile is set)

5Check credential file permissions (Linux/macOS)

On Unix-like systems, the ~/.aws/credentials file must have correct permissions:

bash
chmod 600 ~/.aws/credentials
chmod 700 ~/.aws

Verify permissions:

bash
ls -la ~/.aws/credentials

Output should show:

bash
-rw------- 1 user user ... ~/.aws/credentials

If permissions are too open or too restrictive, AWS SDK may not be able to read the file.

6Use explicit credentials in provider (development only)

For testing purposes, you can hardcode credentials in your provider block:

hcl
provider "aws" {
  region     = "us-east-1"
  access_key = "YOUR_ACCESS_KEY"
  secret_key = "YOUR_SECRET_KEY"
}

WARNING: This is NOT recommended for production. If this file is committed to version control, your credentials will be exposed.

Better approach: Use variables with a .tfvars file:

hcl
variable "aws_access_key" {
  type      = string
  sensitive = true
}

variable "aws_secret_key" {
  type      = string
  sensitive = true
}

provider "aws" {
  region     = "us-east-1"
  access_key = var.aws_access_key
  secret_key = var.aws_secret_key
}

Create terraform.tfvars (do not commit this file):

hcl
aws_access_key = "YOUR_ACCESS_KEY"
aws_secret_key = "YOUR_SECRET_KEY"

Add .tfvars files to .gitignore.

Advanced notes

AWS Provider v4.0 and later changed credential precedence behavior. Previously, if a profile was set in the provider configuration but the profile was invalid, the provider would fall back to environment variables. This is no longer the case. If you set an explicit profile, it must exist and be valid, or Terraform will fail with the 'no valid credential sources' error. For CI/CD environments, use dynamic provider credentials with OpenID Connect (OIDC) for temporary, time-bound credentials instead of long-lived access keys. Terraform Cloud and HCP Terraform support AWS OIDC integration, which eliminates the need to store AWS access keys in CI/CD systems.

Frequently asked questions

What does "Error: configuring Terraform AWS Provider: no valid credential sources" mean?
This error indicates that Terraform has attempted to authenticate with AWS but could not locate any valid credentials through any of its supported authentication methods. The AWS Provider checks multiple credential sources in a specific order, and if none are found or all are invalid, Terraform raises this error. This is a critical blocker that prevents Terraform from communicating with AWS to plan or apply infrastructure changes.
How do I fix "Error: configuring Terraform AWS Provider: no valid credential sources"?
Terraform cannot find valid AWS credentials to authenticate with the AWS Provider. This occurs when credentials are not configured via environment variables, AWS CLI credentials file, IAM roles, or provider settings.
What causes "Error: configuring Terraform AWS Provider: no valid credential sources"?
AWS credentials are not set in any supported location (environment variables, credentials file, IAM role, provider config) AWS access key ID and secret access key environment variables are missing or unset AWS credentials file (~/.aws/credentials) does not exist or is not readable
Is the "Error: configuring Terraform AWS Provider: no valid credential sources" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading