{"record":{"id":"4bb817d4314aeed9","repo":"hashicorp/packer","slug":"unable-to-fetch-project-if-the-provided-credentia","errorCode":null,"errorMessage":"unable to fetch project\n\nIf the provided credentials are tied to a specific project try setting the %s environment variable to one you want to use.","messagePattern":"unable to fetch project\n\nIf the provided credentials are tied to a specific project try setting the (.+?) environment variable to one you want to use\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/hcp/api/client.go","lineNumber":154,"sourceCode":"\t\t}\n\t\treturn nil\n\t}\n\t// Get the project using the organization ID.\n\tlistProjParams := projectSvc.NewProjectServiceListParams()\n\tlistProjParams.ScopeID = &c.OrganizationID\n\tscopeType := string(rmmodels.HashicorpCloudResourcemanagerResourceIDResourceTypeORGANIZATION)\n\tlistProjParams.ScopeType = &scopeType\n\tlistProjResp, err := c.Project.ProjectServiceList(listProjParams, nil)\n\n\tif err != nil {\n\t\t//For permission errors, our service principal may not have the ability\n\t\t// to see all projects for an Org; this is the case for project-level service principals.\n\t\tserviceErr, ok := err.(*projectSvc.ProjectServiceListDefault)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"unable to fetch project list: %v\", err)\n\t\t}\n\t\tif serviceErr.Code() == http.StatusForbidden {\n\t\t\treturn fmt.Errorf(\"unable to fetch project\\n\\n\"+\n\t\t\t\t\"If the provided credentials are tied to a specific project try setting the %s environment variable to one you want to use.\", env.HCPProjectID)\n\t\t}\n\t}\n\n\tif len(listProjResp.Payload.Projects) > 1 {\n\t\tlog.Printf(\"[WARNING] Multiple HCP projects found, will pick the oldest one by default\\n\"+\n\t\t\t\"To specify which project to use, set the %s environment variable to the one you want to use.\", env.HCPProjectID)\n\t}\n\n\tproj, err := getOldestProject(listProjResp.Payload.Projects)\n\tif err != nil {\n\t\treturn err\n\t}\n\tc.ProjectID = proj.ID\n\treturn nil\n}\n\n// getOldestProject retrieves the oldest project from a list based on its created_at time.","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/hcp/api/client.go#L136-L172","documentation":"Raised when the project list API returns HTTP 403 (ProjectServiceListDefault with StatusForbidden), meaning the credentials' service principal cannot list all projects in the organization — typical for project-level service principals. The error explicitly instructs the user to set the HCP_PROJECT_ID environment variable so the client can target one project directly instead of listing. It is an intentional, actionable permission-error path.","triggerScenarios":"ProjectServiceList in loadProjectID returns a *projectSvc.ProjectServiceListDefault whose Code() == http.StatusForbidden, i.e. the principal lacks org-wide project list permission.","commonSituations":"Using a project-scoped HCP service principal (which can only see its own project) without setting HCP_PROJECT_ID; org policies restricting project listing; wrong client credentials bound to a different project than intended.","solutions":["Set the HCP_PROJECT_ID environment variable to the project you want to use.","Alternatively use an organization-level service principal with permission to list projects.","Verify the service principal is bound to the project you expect in the HCP console."],"exampleFix":"// before\n// project-level service principal, no HCP_PROJECT_ID -> 403 on project list\n// after\nexport HCP_PROJECT_ID=\"$(hcp projects list --id-only)\"","handlingStrategy":"validation","validationCode":"if os.Getenv(\"HCP_PROJECT_ID\") == \"\" && isProjectScopedPrincipal(clientID) {\n    return fmt.Errorf(\"set %s for project-level service principals\", \"HCP_PROJECT_ID\")\n}","typeGuard":null,"tryCatchPattern":"if err := client.ValidateRegistryForProject(); err != nil {\n    var svcErr *projectSvc.ProjectServiceListDefault\n    if errors.As(err, &svcErr) && svcErr.Code() == http.StatusForbidden {\n        log.Println(\"Hint: set HCP_PROJECT_ID for project-scoped principals\")\n    }\n    return err\n}","preventionTips":["Always set HCP_PROJECT_ID when using project-level service principals.","Verify principal permissions in the HCP console before CI runs.","Prefer organization-level principals when project listing is needed."],"tags":["hcp","permissions","forbidden","service-principal"],"backgroundTag":"hcp-403-project-scoped-principal","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}