{"record":{"id":"1316fd23b9fb95ce","repo":"hashicorp/terraform","slug":"missing-profile-in-provider-block-v","errorCode":null,"errorMessage":"missing profile in provider block %v","messagePattern":"missing profile in provider block (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":246,"sourceCode":"\t\tcfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tlogger.Debug(\" Configuration provided by: %s\", cfg)\n\n\t\tconfigProviders = append(configProviders, cfg)\n\n\tcase strings.ToLower(AuthSecurityToken):\n\t\tlogger.Info(\"Attempting to authenticate using security token\")\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"can not get %s from Terraform configuration (SecurityToken)\", RegionAttrName)\n\t\t}\n\t\t// if region is part of the provider block make sure it is part of the final configuration too, and overwrites the region in the profile. +\n\t\tregionProvider := common.NewRawConfigurationProvider(\"\", \"\", p.region, \"\", \"\", nil)\n\t\tconfigProviders = append(configProviders, regionProvider)\n\n\t\tif p.configFileProfile == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"missing profile in provider block %v\", ConfigFileProfileAttrName)\n\t\t}\n\n\t\tdefaultPath := path.Join(getHomeFolder(), DefaultConfigDirName, DefaultConfigFileName)\n\t\tif err := checkProfile(p.configFileProfile, defaultPath); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tsecurityTokenBasedAuthConfigProvider, err := common.ConfigurationProviderForSessionTokenWithProfile(defaultPath, p.configFileProfile, p.privateKeyPassword)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not create security token based auth config provider %v\", err)\n\t\t}\n\t\tconfigProviders = append(configProviders, securityTokenBasedAuthConfigProvider)\n\tcase strings.ToLower(ResourcePrincipal):\n\t\tlogger.Info(\"Attempting to authenticate using resource principal credentials\")\n\t\tvar err error\n\t\tvar resourcePrincipalAuthConfigProvider auth.ConfigurationProviderWithClaimAccess\n\n\t\tif p.region == \"\" {\n\t\t\tlogger.Debug(\"did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable\", RegionAttrName)","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L228-L264","documentation":"Returned when auth=\"SecurityToken\" and the config_file_profile attribute is empty. Security token authentication requires a named profile from the OCI config file to load the security token, key, and related settings. Without a profile name, the SDK cannot locate the credentials.","triggerScenarios":"Backend block sets auth=\"SecurityToken\" and region is set, but config_file_profile is missing or empty.","commonSituations":"User set up security token auth but forgot to specify which config file profile to use; user expects DEFAULT profile to be picked up automatically but this code path requires an explicit config_file_profile attribute.","solutions":["Add 'config_file_profile' to the backend block (e.g., config_file_profile = \"DEFAULT\").","Create or verify the profile exists in ~/.oci/config with the security token settings.","Use OCI_CLI_PROFILE environment variable as a fallback if the backend block must stay minimal."],"exampleFix":"// before\nbackend \"oci\" {\n  auth   = \"SecurityToken\"\n  region = \"us-phoenix-1\"\n}\n\n// after\nbackend \"oci\" {\n  auth               = \"SecurityToken\"\n  region             = \"us-phoenix-1\"\n  config_file_profile = \"DEFAULT\"\n}","handlingStrategy":"validation","validationCode":"func validateOCIBackendConfig(cfg BackendConfig) error {\n    if strings.EqualFold(cfg.Auth, \"SecurityToken\") {\n        if cfg.ConfigFileProfile == \"\" {\n            return fmt.Errorf(\"config_file_profile is required for SecurityToken auth\")\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-init validation:\nif err := validateOCIBackendConfig(backendCfg); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Always specify config_file_profile for SecurityToken auth.","Verify the profile exists in ~/.oci/config.","Use a named profile (not relying on implicit DEFAULT) for clarity."],"tags":["oci","authentication","configuration","security-token","profile","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}