How to fix Error: No valid credential sources found for AWS Provider in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 114 views

Terraform cannot find valid AWS credentials to authenticate with AWS. This happens when credentials are not configured via environment variables, shared credentials file, IAM roles, or provider configuration.

Quick fix

Fixes Error: No valid credential sources found for AWS Provider

aws sts get-caller-identity
  1. Verify credentials with AWS CLI
  2. Set AWS credentials via environment variables
  3. Configure AWS shared credentials file
  4. Check for whitespace issues in credentials file
terraform — error
aws sts get-caller-identity
Error: No valid credential sources found for AWS Provider

What this error means

This error occurs when Terraform's AWS Provider cannot locate valid AWS credentials through any of its credential source mechanisms. Terraform searches for credentials in a specific order: environment variables, shared credentials file (~/.aws/credentials), AWS config file (~/.aws/config), EC2 instance IAM roles, and explicit provider configuration. When none of these sources contain valid credentials, the provider cannot authenticate API requests to AWS.

Typical symptoms

  • Terraform plan or apply commands fail immediately with credential error
  • Error occurs even though AWS CLI commands work fine
  • Intermittent credential failures in CI/CD pipelines
  • Running terraform from different environments produces different results

Common causes

  1. AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY environment variables are not set
  2. ~/.aws/credentials file is missing or not in the expected location
  3. AWS credentials file contains whitespace or formatting errors
  4. IAM role is not attached to the EC2 instance running Terraform
  5. AWS Provider version 4.0+ behavior change: explicitly set profile without valid credentials
  6. Credentials have expired or are incorrect
  7. System clock is out of sync (causes AWS signature validation to fail)
  8. EC2 instance metadata service (IMDS) is unreachable or misconfigured

How to fix "Error: No valid credential sources found for AWS Provider"

1Verify credentials with AWS CLI

First, test if AWS credentials are working at all:

bash
aws sts get-caller-identity

If this command fails, your AWS credentials are not properly configured. If it succeeds, the credentials exist but Terraform cannot find them.

2Set AWS credentials via environment variables

The most reliable method for Terraform:

bash
export AWS_ACCESS_KEY_ID=your_access_key_id
export AWS_SECRET_ACCESS_KEY=your_secret_access_key
export AWS_REGION=us-east-1  # Optional, but recommended

Verify they are set:

bash
echo $AWS_ACCESS_KEY_ID
echo $AWS_SECRET_ACCESS_KEY

Then run Terraform again:

bash
terraform plan
3Configure AWS shared credentials file

Create or edit ~/.aws/credentials:

ini
[default]
aws_access_key_id = your_access_key_id
aws_secret_access_key = your_secret_access_key

[profile-name]
aws_access_key_id = another_access_key_id
aws_secret_access_key = another_secret_access_key

Ensure file permissions are correct (readable only by you):

bash
chmod 600 ~/.aws/credentials

Then specify the profile in your Terraform provider:

hcl
provider "aws" {
  region  = "us-east-1"
  profile = "default"
}
4Check for whitespace issues in credentials file

There is a known bug where extra whitespace or empty profiles in ~/.aws/credentials can interfere with credential detection. Try:

1. Backup your credentials file: cp ~/.aws/credentials ~/.aws/credentials.bak
2. Edit the file and remove all empty sections or extra whitespace
3. Keep only the profile(s) you are actually using
4. Verify file format is exact with no trailing spaces:

bash
cat -A ~/.aws/credentials

5. Start a fresh terminal session and test again

5Use EC2 instance IAM role (for EC2 deployments)

If running Terraform on an EC2 instance, use instance profiles instead:

1. Create an IAM role with necessary permissions (e.g., AmazonEC2FullAccess)
2. Create an instance profile from that role
3. Attach the instance profile to your EC2 instance
4. No credentials needed in Terraform - it will auto-detect the instance role

Terraform provider configuration:

hcl
provider "aws" {
  region = "us-east-1"
  # Credentials will be auto-detected from instance profile
}
6Verify AWS Provider version compatibility

AWS Provider v4.0+ changed credential precedence behavior. If upgrading from v3.x:

1. Check your current provider version:

hcl
terraform providers

2. If you explicitly set a profile in the provider block but that profile doesn't exist or has no valid credentials, v4.0+ will fail (v3.x would fall back to env vars)

3. Solution: Either remove the explicit profile setting, or ensure the profile exists with valid credentials

hcl
# Option 1: Remove explicit profile
provider "aws" {
  region = "us-east-1"
}

# Option 2: Ensure profile exists and has valid credentials
provider "aws" {
  region  = "us-east-1"
  profile = "myprofile"  # Must exist in ~/.aws/credentials
}
7Sync system clock if running in VM

AWS signature validation is time-sensitive. If running Terraform in a VM (Vagrant, VirtualBox, etc.) that has been up for days, the clock may drift:

bash
# Check system time
date

# Sync clock (requires NTP or manual adjustment)
sudo ntpdate -s time.nist.gov  # Linux
# or
sudo sntp -s time.apple.com    # macOS

If using Vagrant/VirtualBox, restart the VM to force clock sync:

bash
vagrant halt
vagrant up

Advanced notes

AWS Provider v4.0 Breaking Change: In v3.x, if you set an explicit profile that didn't exist, Terraform would fall back to environment variables. In v4.0+, it will error instead. If migrating from v3.x to v4.0+, audit your provider configurations.

EC2 Metadata Service (IMDS): When running Terraform from EC2 instances (especially in Terraform Cloud or Enterprise), ensure IMDSv2 is enabled with proper http-put-response-hop-limit configuration. Some container environments may have IMDS disabled.

IAM Permission Errors: This error is specifically about credential *sources*, not permissions. If credentials are found but you get a different error like InvalidClientTokenId or AccessDenied, that's a permissions issue, not a credentials source issue.

Rate Limiting in CI/CD: Adding -parallelism=4 to terraform commands can help reduce intermittent failures when credentials are being accessed from shared metadata services.

Frequently asked questions

What does "Error: No valid credential sources found for AWS Provider" mean?
This error occurs when Terraform's AWS Provider cannot locate valid AWS credentials through any of its credential source mechanisms. aws/config), EC2 instance IAM roles, and explicit provider configuration. When none of these sources contain valid credentials, the provider cannot authenticate API requests to AWS.
How do I fix "Error: No valid credential sources found for AWS Provider"?
Terraform cannot find valid AWS credentials to authenticate with AWS. This happens when credentials are not configured via environment variables, shared credentials file, IAM roles, or provider configuration.
What causes "Error: No valid credential sources found for AWS Provider"?
AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY environment variables are not set ~/.aws/credentials file is missing or not in the expected location AWS credentials file contains whitespace or formatting errors
Is the "Error: No valid credential sources found for AWS Provider" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading