How to fix Error: timeout - last error: dial tcp: i/o timeout in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 204 views

This networking error occurs when Terraform cannot establish a connection to a cloud provider, registry, or remote resource. It typically indicates DNS resolution failures, network connectivity issues, or security group/firewall restrictions blocking the required ports.

Quick fix

Fixes Error: timeout - last error: dial tcp: i/o timeout

# Test with curl (for HTTP/HTTPS endpoints)
curl -v https://api.example.com:443

# Test with nc (netcat) for TCP connectivity
nc -zv 54.89.109.252 22

# Test with timeout to prevent hanging
timeout 5 bash -c '</dev/tcp/54.89.109.252/22' && echo "Connected" || echo "Connection failed"
  1. Verify network connectivity with curl or telnet
  2. Check and fix security group and firewall rules
  3. Configure proxy settings if behind corporate proxy
  4. Verify DNS resolution is working
terraform — error
# Test with curl (for HTTP/HTTPS endpoints)
curl -v https://api.example.com:443
# Test with nc (netcat) for TCP connectivity
nc -zv 54.89.109.252 22
# Test with timeout to prevent hanging
timeout 5 bash -c '</dev/tcp/54.89.109.252/22' && echo "Connected" || echo "Connection failed"
Error: timeout - last error: dial tcp: i/o timeout

What this error means

The "dial tcp: i/o timeout" error is a Go networking error that means Terraform tried to connect to a network address but the connection attempt timed out without receiving a response. This can happen during several Terraform operations: 1. **Provider initialization**: Terraform cannot reach the cloud provider's API endpoints 2. **Registry communication**: Cannot download providers from registry.terraform.io 3. **Remote provisioners**: SSH connections fail when using file or remote-exec provisioners 4. **Kubernetes/Cluster operations**: Cannot establish connections to cluster APIs The "dial tcp" part specifically refers to establishing a TCP connection, and "i/o timeout" means the operation didn't complete within the timeout window.

Typical symptoms

  • Terraform plan or apply hangs then fails with timeout error
  • Error messages mention specific IP addresses and ports (e.g., 54.89.109.252:22)
  • Operations work sometimes but fail sporadically (intermittent connectivity)
  • SSH provisioners fail during remote-exec or file provisioner steps
  • Provider initialization fails when pulling from registry
  • Kubernetes provider cannot communicate with cluster

Common causes

  1. Network connectivity issues: Firewall or security group rules blocking required ports or IP addresses
  2. DNS resolution failures: DNS servers unreachable or misconfigured, preventing hostname lookups
  3. Proxy configuration problems: HTTP/HTTPS proxy settings not properly configured in environment
  4. Resource not ready: VM instance still booting or service not yet accepting connections
  5. Incorrect endpoint configuration: Provider configuration pointing to wrong API endpoint or port
  6. Route/VPC issues: Instance in VPC without proper internet gateway or routing configuration
  7. Network latency: Very slow networks causing legitimate requests to exceed timeout limits

How to fix "Error: timeout - last error: dial tcp: i/o timeout"

1Verify network connectivity with curl or telnet

First, test basic network connectivity to the endpoint. Replace the IP and port with your actual endpoint:

bash
# Test with curl (for HTTP/HTTPS endpoints)
curl -v https://api.example.com:443

# Test with nc (netcat) for TCP connectivity
nc -zv 54.89.109.252 22

# Test with timeout to prevent hanging
timeout 5 bash -c '</dev/tcp/54.89.109.252/22' && echo "Connected" || echo "Connection failed"

If these commands fail, it confirms network connectivity is blocked. If they succeed, the issue may be specific to Terraform or the provider.

2Check and fix security group and firewall rules

Ensure your security groups and firewall rules allow outbound traffic to the required endpoints:

For AWS security groups:
- Add outbound rules allowing HTTPS (443) to cloud provider API endpoints
- If using SSH provisioners, allow SSH (22) to your instance IP

For Azure Network Security Groups:
- Create outbound rules allowing HTTPS (443) and SSH (22) as needed
- Verify no deny rules are blocking required traffic

For GCP firewall rules:
- Create egress rules allowing traffic to required endpoints
- Ensure rules have correct priorities and don't conflict

Example AWS CLI command:

bash
aws ec2 authorize-security-group-egress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0
3Configure proxy settings if behind corporate proxy

If your network uses an HTTP/HTTPS proxy, configure Terraform to use it:

bash
# Set environment variables before running Terraform
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1,internal.example.com

# Or in PowerShell on Windows
$env:HTTP_PROXY = "http://proxy.example.com:8080"
$env:HTTPS_PROXY = "http://proxy.example.com:8080"

# Then run Terraform
terraform plan

You can also add these to your shell profile to make them persistent:

bash
echo 'export HTTPS_PROXY=http://proxy.example.com:8080' >> ~/.bashrc
source ~/.bashrc
4Verify DNS resolution is working

If you're getting timeouts on DNS lookups, test DNS resolution:

bash
# Test DNS resolution
nslookup api.example.com
dig api.example.com

# Or use getent on Linux
getent hosts api.example.com

# Test with different DNS server
nslookup api.example.com 8.8.8.8

If DNS lookups fail:
- Check /etc/resolv.conf on Linux to verify nameserver configuration
- On Windows, run ipconfig /all to see DNS servers
- Try using a public DNS server (8.8.8.8) for testing
- Contact your network administrator if DNS is misconfigured

5Ensure VPC and routing are properly configured

For cloud provisioners, verify your VPC has proper routing:

For AWS EC2 instances in a VPC:
- Instance must be in a subnet with a route to an Internet Gateway (IGW)
- Check route table: destination 0.0.0.0/0 should point to the IGW

Check routing in AWS console:
- Go to EC2 > Instances > Your Instance > Subnet
- Check Route Table > verify routes include IGW

For on-premises or private networks:
- Ensure instance has connectivity to your Terraform control machine
- If using jumphosts/bastion hosts, configure SSH ProxyCommand

Example for SSH through bastion:

bash
# In ~/.ssh/config
Host private-instance
  HostName 10.0.0.5
  ProxyCommand ssh -W %h:%p bastion-host
  User ec2-user
6Increase timeout values for slow networks

If connectivity works but operations are slow, increase Terraform timeouts:

hcl
# For remote-exec provisioner
resource "aws_instance" "example" {
  # ... other configuration ...

  provisioner "remote-exec" {
    inline = ["echo 'Hello'"]

    connection {
      type        = "ssh"
      user        = "ec2-user"
      private_key = file("~/.ssh/id_rsa")
      host        = self.public_ip
      timeout     = "5m"  # Increase from default 5m
    }
  }
}

# For resource timeouts
resource "aws_instance" "example" {
  # ... other configuration ...

  timeouts {
    create = "10m"
    delete = "10m"
  }
}

Provider-specific timeout examples:

hcl
# Kubernetes provider
provider "kubernetes" {
  host  = aws_eks_cluster.example.endpoint
  token = data.aws_eks_cluster_auth.example.token

  # Add connection settings
  insecure = false
  load_config_file = false
}

# AWS provider
provider "aws" {
  region = "us-east-1"

  # Some operations may benefit from retry configuration
}
7Enable debug logging to identify the exact endpoint

Enable verbose logging to see exactly where Terraform is trying to connect:

bash
# Enable Terraform debug logging
export TF_LOG=DEBUG
export TF_LOG_PATH=terraform.log

terraform plan 2>&1 | tee terraform.log

# Search for network-related errors
grep -i "dial|timeout|connection" terraform.log

# For AWS provider debugging
export AWS_DEBUG=true

# For Kubernetes provider debugging
export KUBERNETES_DEBUG=true

Debug logs will show:
- The exact IP address and port being connected to
- DNS lookup details
- Which provider/component is timing out
- Connection attempt duration before timeout

Advanced notes

IPv6 Issues on macOS: If you're experiencing slow Terraform runs or timeouts on macOS, check System Settings > Network and disable IPv6. Some networks have issues with IPv6 that can cause significant slowdowns. The HashiCorp Terraform team has been tracking this issue (https://github.com/hashicorp/terraform/issues/31467).

Intermittent Timeouts: If timeouts occur sporadically (not consistently), this suggests a reliability issue rather than a complete network blockage. This could be:
- Unstable network connection quality
- Rate limiting on the remote endpoint (temporary rejection)
- Load balancer or proxy dropping connections randomly

Try running the same command multiple times to see if it eventually succeeds.

Kubernetes Provider Specifics: When using the Kubernetes provider and getting "dial tcp: i/o timeout", ensure:
- The cluster is running and the API server is accessible
- Security groups allow egress to the Kubernetes API port (usually 443)
- If using kubeconfig, verify the server endpoint in the kubeconfig file is correct
- For EKS, ensure the security group allows inbound access to port 443

Frequently asked questions

What does "Error: timeout - last error: dial tcp: i/o timeout" mean?
The "dial tcp: i/o timeout" error is a Go networking error that means Terraform tried to connect to a network address but the connection attempt timed out without receiving a response. This can happen during several Terraform operations: 1. Provider initialization: Terraform cannot reach the cloud provider's API endpoints 2.
How do I fix "Error: timeout - last error: dial tcp: i/o timeout"?
This networking error occurs when Terraform cannot establish a connection to a cloud provider, registry, or remote resource. It typically indicates DNS resolution failures, network connectivity issues, or security group/firewall restrictions blocking the required ports.
What causes "Error: timeout - last error: dial tcp: i/o timeout"?
Network connectivity issues: Firewall or security group rules blocking required ports or IP addresses DNS resolution failures: DNS servers unreachable or misconfigured, preventing hostname lookups Proxy configuration problems: HTTP/HTTPS proxy settings not properly configured in environment
Is the "Error: timeout - last error: dial tcp: i/o timeout" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading