{"record":{"id":"1367a8800b3e5fff","repo":"hashicorp/terraform","slug":"provider-download-blocked-due-to-policy-violations","errorCode":null,"errorMessage":"Provider download blocked due to policy violations. Please review other diagnostics for details.","messagePattern":"Provider download blocked due to policy violations\\. Please review other diagnostics for details\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/meta_policy.go","lineNumber":175,"sourceCode":"\t\t\tVersion:   version,\n\t\t},\n\t})\n\t// We use the root module as the module for provider configs since the version resolution\n\t// is ambiguous, and we do not know which module the provider config belongs to.\n\taddr := addrs.AbsProviderConfig{Provider: provider, Module: addrs.RootModule}\n\tproviderConfig := p.rootModule.ProviderConfigs[provider.Type]\n\n\tif providerConfig != nil {\n\t\t// Annotate the result diagnostics with the local range so that diagnostics can be rendered with both the\n\t\t// policy source and the object being enforced.\n\t\tresult = result.WithLocalRange(providerConfig.DeclRange.Ptr())\n\t}\n\tp.view.PolicyResult(addr.String(), result)\n\tlog.Println(\"[DEBUG] init: policy result for provider\", provider.String(), version, \"overall\", result.Overall)\n\t// Init uses diagnostics as the blocking signal because advisory policies\n\t// may return deny without any error diagnostics.\n\tif result.Diagnostics.HasErrors() {\n\t\treturn fmt.Errorf(\"Provider download blocked due to policy violations. Please review other diagnostics for details.\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":157,"sourceCodeEnd":180,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/meta_policy.go#L157-L180","documentation":"Raised during init when an HCP Terraform / Terraform Enterprise policy evaluation (provider policy) returns error-level diagnostics, blocking the provider download. The policy (e.g. a Sentinel policy set or a custom policy) denied the provider. Details are emitted as separate diagnostics before this summary error.","triggerScenarios":"meta_policy.go: result.Diagnostics.HasErrors() is true after PolicyEvaluateProviderRequest for a provider during init. Triggered when the configured policy set rejects a provider (e.g. disallows registry/hashicorp providers not on an allow-list, or version constraints fail policy).","commonSituations":"Organization mandates a provider allow-list and a requested provider is not permitted; a Sentinel policy requires specific provider versions; new/unapproved provider added to config; policy set updated to block a previously-allowed provider.","solutions":["Review the other diagnostics emitted before this error — they name the policy and the provider that failed.","Update the policy set (in HCP Terraform / TFE) to allow the required provider/version, or use an approved alternative.","Remove the disallowed provider from your configuration.","Verify the provider source address and version match what the policy expects."],"exampleFix":"// before\n// terraform init -> Provider download blocked due to policy violations\n\n// after\n// In HCP Terraform/TFE policy set: allow registry.terraform.io/hashicorp/aws\n// then re-run:\nterraform init","handlingStrategy":"validation","validationCode":"// Pre-check your config's providers against the org allow-list before init\nfor _, p := range requiredProviders {\n    if !allowList.Contains(p.Source) {\n        return fmt.Errorf(\"provider %s not allowed by policy\", p.Source)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Review the other diagnostics — they name the failing policy and provider.","Keep provider sources/versions within the org policy allow-list.","Coordinate policy set changes before adopting new providers.","Remove disallowed providers from configuration before running init."],"tags":["terraform","policy","sentinel","hcp-terraform","providers","governance"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}