How to fix Error: error listing resources: operation error in Terraform

TerraformINTERMEDIATEMEDIUM

This error occurs when Terraform fails to list AWS resources during plan or apply operations. Common causes include missing IAM permissions, connectivity issues, or API throttling. Fix it by verifying credentials, checking IAM policies, and reviewing API rate limits.

What this error means

The "error listing resources: operation error" message appears when the Terraform AWS provider fails to enumerate resources from AWS APIs. This typically happens during data source lookups, when Terraform queries AWS to discover existing resources, check state, or apply changes. The error usually masks the underlying API failure—it could be an authentication error, permission error, service limit, or networking issue. This error is common in S3 backends (ListObjectsV2), service enumeration (LakeFormation, RDS, DynamoDB), and when querying data sources with insufficient permissions.

How to fix "Error: error listing resources: operation error"

1Enable debug logging to see the actual API error

Set the TF_LOG environment variable to DEBUG to see what operation actually failed:

bash

export TF_LOG=DEBUG
terraform plan 2>&1 | grep -A 10 "operation error"

Or use TRACE for even more detail:

bash

export TF_LOG=TRACE
terraform plan > terraform.log 2>&1
grep "operation error" terraform.log

Look for the specific AWS API operation (e.g., "S3: ListObjectsV2", "EC2: DescribeInstances"). This tells you exactly which permission is missing or which service is failing.

2Verify AWS credentials are valid and not expired

Test that your credentials work:

bash

aws sts get-caller-identity

This should return your AWS Account ID, User ARN, and User ID. If it fails or returns nothing:

1. For local development: Check ~/.aws/credentials and ~/.aws/config
2. For CI/CD: Verify AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
3. For EC2/Lambda: Ensure the IAM role is attached
4. For temporary credentials: Check expiration with:

bash

aws sts get-session-token  # If using MFA
# Or check STS assume-role session tokens in credentials file for expiration time

If credentials are expired, refresh them or use a service with automatic credential rotation (IAM roles on EC2, IRSA in Kubernetes, etc.).

3Check IAM permissions for the failing operation

Once you know the specific operation from the debug logs (e.g., "S3: ListObjectsV2"), verify your IAM policy includes it:

bash

# Check which user/role Terraform is using
aws sts get-caller-identity

# View inline and attached policies
aws iam list-attached-user-policies --user-name YOUR_USER
aws iam get-user-policy --user-name YOUR_USER --policy-name POLICY_NAME

Ensure your policy includes the required action. For example, if you're hitting S3 bucket errors:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket",
        "arn:aws:s3:::your-bucket/*"
      ]
    }
  ]
}

For general Terraform AWS operations, ensure policies include ec2:Describe* and related read operations on the resources you're managing.

4Check AWS API rate limits and retry with backoff

If the error is transient, it may be API throttling. Terraform automatically retries, but you can adjust retry behavior:

bash

# First, try a simple retry
terraform plan

If it succeeds on retry, the issue was likely throttling. For production, use an S3 backend with DynamoDB for state locking, which includes built-in retry logic.

If you're in an account with high API usage, request a service quota increase:

bash

# Check current API call quotas in AWS Service Quotas console
# https://console.aws.amazon.com/servicequotas

Common limit causes:
- First Terraform init/plan in a new workspace (AWS lists all resources)
- Importing many resources at once
- Concurrent Terraform operations in the same AWS account

5Verify S3 backend access (if using S3 state)

If you're using an S3 backend, the error may be during state operations. Check:

bash

# Test S3 bucket access
aws s3 ls s3://your-bucket/path/to/terraform.tfstate

# Test DynamoDB state lock table access (if using state locking)
aws dynamodb scan --table-name terraform-locks --max-items 1

Ensure your IAM policy includes:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::your-terraform-bucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::your-terraform-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeTable",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": "arn:aws:dynamodb:REGION:ACCOUNT:table/terraform-locks"
    }
  ]
}

6Verify network and region configuration

Ensure you're targeting the correct AWS region:

bash

# Check your Terraform provider config
grep -A 3 "provider "aws"" *.tf

# Verify AWS_REGION environment variable
echo $AWS_REGION

# Test connectivity to AWS endpoints
aws ec2 describe-instances --region us-east-1

If using a VPC endpoint or private network, ensure:
- VPC endpoints are enabled for the services you're accessing
- Security groups allow outbound HTTPS (port 443) to AWS API endpoints
- No firewall rules are blocking AWS API domains

For LocalStack or Moto (local testing), ensure the endpoint URL is correctly configured:

hcl

provider "aws" {
  region            = "us-east-1"
  access_key        = "test"
  secret_key        = "test"
  skip_credentials_validation = true
  skip_metadata_api_check     = true

  # Only for LocalStack
  endpoints {
    s3 = "http://localhost:4566"
    ec2 = "http://localhost:4566"
  }
}

How to fix Error: error listing resources: operation error in Terraform

What this error means

Typical symptoms

Common causes

How to fix "Error: error listing resources: operation error"

Advanced notes

Related errors

Official resources & further reading