{"record":{"id":"33ba05929374198c","repo":"hashicorp/terraform","slug":"can-not-get-s-from-terraform-configuration-secur","errorCode":null,"errorMessage":"can not get %s from Terraform configuration (SecurityToken)","messagePattern":"can not get (.+?) from Terraform configuration \\(SecurityToken\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":239,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"can not read intermediate certificate from %s\", filepath.Join(certsDir, \"intermediate.pem\"))\n\t\t}\n\n\t\tintermediateCertificatesBytes := [][]byte{\n\t\t\tintermediateCertificateBytes,\n\t\t}\n\n\t\tcfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tlogger.Debug(\" Configuration provided by: %s\", cfg)\n\n\t\tconfigProviders = append(configProviders, cfg)\n\n\tcase strings.ToLower(AuthSecurityToken):\n\t\tlogger.Info(\"Attempting to authenticate using security token\")\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"can not get %s from Terraform configuration (SecurityToken)\", RegionAttrName)\n\t\t}\n\t\t// if region is part of the provider block make sure it is part of the final configuration too, and overwrites the region in the profile. +\n\t\tregionProvider := common.NewRawConfigurationProvider(\"\", \"\", p.region, \"\", \"\", nil)\n\t\tconfigProviders = append(configProviders, regionProvider)\n\n\t\tif p.configFileProfile == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"missing profile in provider block %v\", ConfigFileProfileAttrName)\n\t\t}\n\n\t\tdefaultPath := path.Join(getHomeFolder(), DefaultConfigDirName, DefaultConfigFileName)\n\t\tif err := checkProfile(p.configFileProfile, defaultPath); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tsecurityTokenBasedAuthConfigProvider, err := common.ConfigurationProviderForSessionTokenWithProfile(defaultPath, p.configFileProfile, p.privateKeyPassword)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not create security token based auth config provider %v\", err)\n\t\t}\n\t\tconfigProviders = append(configProviders, securityTokenBasedAuthConfigProvider)","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L221-L257","documentation":"Returned inside getConfigProviders() when auth=\"SecurityToken\" but 'region' is empty. Security token authentication reads credentials from an OCI config file profile, but the region still must be set (either in the backend block or resolved from the profile). The backend explicitly checks for region before proceeding.","triggerScenarios":"Backend block sets auth=\"SecurityToken\" but omits 'region', and the region is not resolvable from the config file profile path at this check point.","commonSituations":"User switched from API key to security token auth but forgot to add region; user expects the config file profile to supply region but the backend block's empty region check fails first; config_file_profile is set but the check for region happens before profile loading.","solutions":["Add 'region' to the backend block (e.g., region = \"us-phoenix-1\").","Set the OCI_CLI_REGION / OCI_REGION environment variable.","Verify the config file profile has a region entry, though the backend block's region takes precedence."],"exampleFix":"// before\nbackend \"oci\" {\n  auth               = \"SecurityToken\"\n  config_file_profile = \"DEFAULT\"\n}\n\n// after\nbackend \"oci\" {\n  auth               = \"SecurityToken\"\n  config_file_profile = \"DEFAULT\"\n  region              = \"us-phoenix-1\"\n}","handlingStrategy":"validation","validationCode":"func validateOCIBackendConfig(cfg BackendConfig) error {\n    if strings.EqualFold(cfg.Auth, \"SecurityToken\") {\n        if cfg.Region == \"\" {\n            return fmt.Errorf(\"region is required for SecurityToken auth\")\n        }\n        if cfg.ConfigFileProfile == \"\" {\n            return fmt.Errorf(\"config_file_profile is required for SecurityToken auth\")\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-init validation:\nif err := validateOCIBackendConfig(backendCfg); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Always set region explicitly for SecurityToken auth.","Verify the OCI config file profile has a region entry.","Use OCI_CLI_REGION as a fallback environment variable."],"tags":["oci","authentication","configuration","security-token","region","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}