Terraform

Problem

`terraform plan` fails before it even reaches a resource, with a provider-level authentication error (e.g. AWS NoCredentialProviders / InvalidClientTokenId, or an Azure client-build error).

Symptoms

• Error: No valid credential sources found
• error validating provider credentials: error calling sts:GetCallerIdentity
• Works on one machine, fails in CI

Root Cause

The provider block can't find valid credentials via the SDK's normal credential chain (env vars, shared config file, instance role, etc.), or the credentials it found are expired, invalid, or missing required permissions.

Solution

aws sts get-caller-identity

AWS_SDK_LOAD_CONFIG=1 aws configure list

export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_DEFAULT_REGION=us-east-1

provider "aws" {
  region  = "us-east-1"
  profile = "my-profile"
}

permissions:
  id-token: write
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/terraform-ci
    aws-region: us-east-1

terraform plan

Prevention

• Prefer short-lived OIDC/federated credentials in CI over static access keys
• Never commit provider credentials to the repo, even in a .tfvars file
• Rotate long-lived keys on a schedule and check expiry before it becomes an outage
• Give the CI role only the IAM permissions the specific Terraform config actually needs

References

• AWS Provider authentication
• GitHub Actions OIDC with AWS