How to fix Error: No valid credential sources found for AWS Provider in Terraform

First, test if AWS credentials are working at all:

aws sts get-caller-identity

If this command fails, your AWS credentials are not properly configured. If it succeeds, the credentials exist but Terraform cannot find them.

The most reliable method for Terraform:

export AWS_ACCESS_KEY_ID=your_access_key_id
export AWS_SECRET_ACCESS_KEY=your_secret_access_key
export AWS_REGION=us-east-1  # Optional, but recommended

Verify they are set:

echo $AWS_ACCESS_KEY_ID
echo $AWS_SECRET_ACCESS_KEY

Then run Terraform again:

terraform plan

Create or edit ~/.aws/credentials:

[default]
aws_access_key_id = your_access_key_id
aws_secret_access_key = your_secret_access_key

[profile-name]
aws_access_key_id = another_access_key_id
aws_secret_access_key = another_secret_access_key

Ensure file permissions are correct (readable only by you):

chmod 600 ~/.aws/credentials

Then specify the profile in your Terraform provider:

provider "aws" {
  region  = "us-east-1"
  profile = "default"
}

There is a known bug where extra whitespace or empty profiles in ~/.aws/credentials can interfere with credential detection. Try:

1. Backup your credentials file: cp ~/.aws/credentials ~/.aws/credentials.bak
2. Edit the file and remove all empty sections or extra whitespace
3. Keep only the profile(s) you are actually using
4. Verify file format is exact with no trailing spaces:

cat -A ~/.aws/credentials

5. Start a fresh terminal session and test again

If running Terraform on an EC2 instance, use instance profiles instead:

1. Create an IAM role with necessary permissions (e.g., AmazonEC2FullAccess)
2. Create an instance profile from that role
3. Attach the instance profile to your EC2 instance
4. No credentials needed in Terraform - it will auto-detect the instance role

Terraform provider configuration:

provider "aws" {
  region = "us-east-1"
  # Credentials will be auto-detected from instance profile
}

AWS Provider v4.0+ changed credential precedence behavior. If upgrading from v3.x:

1. Check your current provider version:

terraform providers

2. If you explicitly set a profile in the provider block but that profile doesn't exist or has no valid credentials, v4.0+ will fail (v3.x would fall back to env vars)

3. Solution: Either remove the explicit profile setting, or ensure the profile exists with valid credentials

# Option 1: Remove explicit profile
provider "aws" {
  region = "us-east-1"
}

# Option 2: Ensure profile exists and has valid credentials
provider "aws" {
  region  = "us-east-1"
  profile = "myprofile"  # Must exist in ~/.aws/credentials
}

AWS signature validation is time-sensitive. If running Terraform in a VM (Vagrant, VirtualBox, etc.) that has been up for days, the clock may drift:

# Check system time
date

# Sync clock (requires NTP or manual adjustment)
sudo ntpdate -s time.nist.gov  # Linux
# or
sudo sntp -s time.apple.com    # macOS

If using Vagrant/VirtualBox, restart the VM to force clock sync:

vagrant halt
vagrant up