How to fix Error: Attempted to load application default credentials since neither credentials nor access_token was set in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 114 views

Terraform cannot authenticate with Google Cloud because Application Default Credentials (ADC) are not configured. This happens when neither explicit credentials nor access tokens are provided in the provider block.

Quick fix

Fixes Error: Attempted to load application default credentials since neither credentials nor access_token was set

gcloud auth application-default login
  1. Run gcloud auth application-default login
  2. Set your GCP project
  3. Configure quota project (optional but recommended)
  4. Verify credentials in Terraform (minimal provider block)
terraform — error
gcloud auth application-default login
Error: Attempted to load application default credentials since neither credentials nor access_token was set

What this error means

When Terraform tries to create or manage GCP resources, it attempts to load application default credentials automatically. This error occurs because no credentials are available through any of the expected authentication methods: not explicitly configured in the provider block, not set via GOOGLE_APPLICATION_CREDENTIALS environment variable, and not created via 'gcloud auth application-default login'. Google Cloud falls back to looking for a service account on the metadata server, which also fails.

Typical symptoms

  • Terraform plan or apply commands fail immediately when using google provider
  • Error message mentions 'could not find default credentials'
  • Works on local machine but fails in CI/CD pipelines
  • Commands like 'terraform import' fail with authentication errors

Common causes

  1. gcloud auth application-default login has not been run on the system
  2. GOOGLE_APPLICATION_CREDENTIALS environment variable is not set or points to invalid file
  3. Service account credentials are not provided in the Terraform provider block
  4. Running Terraform in an environment without attached service account (e.g., not on GCE/GKE)
  5. Credentials file has been deleted or moved since initial setup
  6. Using terraform import locally but credentials were set in Terraform Cloud only

How to fix "Error: Attempted to load application default credentials since neither credentials nor access_token was set"

1Run gcloud auth application-default login

This is the recommended solution for local development. Run the following command to set up Application Default Credentials:

bash
gcloud auth application-default login

This command opens a browser window to authenticate your user account and stores credentials in ~/.config/gcloud/application_default_credentials.json. Terraform will automatically discover and use these credentials.

2Set your GCP project

After authentication, configure your default GCP project:

bash
gcloud config set project YOUR_PROJECT_ID

Replace YOUR_PROJECT_ID with your actual Google Cloud project ID. You can find this in the Google Cloud Console.

3Configure quota project (optional but recommended)

If you see a warning about missing quota project, run:

bash
gcloud auth application-default set-quota-project YOUR_PROJECT_ID

This ensures proper quota tracking for your Terraform operations.

4Verify credentials in Terraform (minimal provider block)

Once ADC is set up, your Terraform provider block can be minimal:

hcl
provider "google" {
  project = "my-gcp-project"
  region  = "us-central1"
}

Terraform automatically searches for credentials in this order: GOOGLE_APPLICATION_CREDENTIALS environment variable, ADC file created by gcloud auth application-default login, and the attached service account (if running on GCP).

5Use service account for CI/CD pipelines

For automated environments (GitHub Actions, GitLab CI, Terraform Cloud), create a service account and provide credentials:

bash
# Create service account
gcloud iam service-accounts create terraform-bot --display-name="Terraform Bot"

# Grant necessary roles
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:terraform-bot@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/editor"

# Create and download key
gcloud iam service-accounts keys create key.json \
  --iam-account=terraform-bot@YOUR_PROJECT_ID.iam.gserviceaccount.com

Then set the environment variable in your CI/CD:

bash
export GOOGLE_APPLICATION_CREDENTIALS="$(pwd)/key.json"
6Service account impersonation (alternative for CI/CD)

If using service account impersonation instead of key files:

bash
gcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL

Make sure your user account has the 'Service Account Token Creator' (roles/iam.serviceAccountTokenCreator) IAM role on the service account.

7For Terraform Cloud: set GOOGLE_CREDENTIALS variable

In Terraform Cloud/HCP Terraform, create an environment variable named GOOGLE_CREDENTIALS in your workspace:

1. Go to your workspace settings
2. Click 'Variables' tab
3. Add variable: GOOGLE_CREDENTIALS
4. Set value to the contents of your service account JSON key:

bash
cat /path/to/service-account-key.json | jq -c

5. Check the 'Sensitive' checkbox
6. Save the variable

Advanced notes

Service account keys are a security risk if stored in version control. Prefer using service account impersonation, workload identity federation (for Kubernetes), or attaching service accounts to compute resources. On Google Cloud resources (Compute Engine, GKE, Cloud Functions), prefer using the attached service account instead of creating separate keys. For Terraform Cloud, use dynamic credentials with OIDC workload identity federation instead of static service account keys when possible.

Frequently asked questions

What does "Error: Attempted to load application default credentials since neither" mean?
When Terraform tries to create or manage GCP resources, it attempts to load application default credentials automatically. This error occurs because no credentials are available through any of the expected authentication methods: not explicitly configured in the provider block, not set via GOOGLE_APPLICATION_CREDENTIALS environment variable, and not created via 'gcloud auth application-default login'. Google Cloud falls back to looking for a service account on the metadata server, which also fails.
How do I fix "Error: Attempted to load application default credentials since neither"?
Terraform cannot authenticate with Google Cloud because Application Default Credentials (ADC) are not configured. This happens when neither explicit credentials nor access tokens are provided in the provider block.
What causes "Error: Attempted to load application default credentials since neither"?
gcloud auth application-default login has not been run on the system GOOGLE_APPLICATION_CREDENTIALS environment variable is not set or points to invalid file Service account credentials are not provided in the Terraform provider block
Is the "Error: Attempted to load application default credentials since neither" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading