{"record":{"id":"c69992e29b0cea02","repo":"hashicorp/terraform","slug":"auth-must-be-one-of-s-or-s-or-s-or-s-o","errorCode":null,"errorMessage":"auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or '%s'","messagePattern":"auth must be one of '(.+?)' or '(.+?)' or '(.+?)' or '(.+?)' or '(.+?)' or '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":281,"sourceCode":"\t\tif p.region == \"\" {\n\t\t\tlogger.Debug(\"did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable\", RegionAttrName)\n\t\t\tresourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProvider()\n\t\t} else {\n\t\t\tresourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProviderForRegion(common.StringToRegion(p.region))\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tconfigProviders = append(configProviders, resourcePrincipalAuthConfigProvider)\n\tcase strings.ToLower(AuthOKEWorkloadIdentity):\n\t\tlogger.Info(\"Attempting to authenticate using OKE workload identity\")\n\t\tokeWorkloadIdentityConfigProvider, err := auth.OkeWorkloadIdentityConfigurationProvider()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not get oke workload indentity based auth config provider %v\", err)\n\t\t}\n\t\tconfigProviders = append(configProviders, okeWorkloadIdentityConfigProvider)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or '%s'\", AuthAPIKeySetting, AuthInstancePrincipalSetting, AuthInstancePrincipalWithCertsSetting, AuthSecurityToken, ResourcePrincipal, AuthOKEWorkloadIdentity)\n\t}\n\n\treturn configProviders, nil\n}\nfunc (p ociAuthConfigProvider) getSdkConfigProvider() (common.ConfigurationProvider, error) {\n\n\tconfigProviders, err := p.getConfigProviders()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tconfigProviders = append(configProviders, p)\n\t//In GoSDK, the first step is to check if AuthType exists,\n\t//for composite provider, we only check the first provider in the list for the AuthType.\n\t//Then SDK will based on the AuthType to Create the actual provider if it's a valid value.\n\t//If not, then SDK will base on the order in the composite provider list to check for necessary info (tenancyid, userID, fingerprint, region, keyID).\n\tif p.configFileProfile == \"\" {\n\t\tconfigProviders = append(configProviders, common.DefaultConfigProvider())","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L263-L299","documentation":"Returned by the default case of the switch statement in getConfigProviders() when the 'auth' value does not match any of the supported authentication types: APIKey, InstancePrincipal, InstancePrincipalWithCerts, SecurityToken, ResourcePrincipal, or OKEWorkloadIdentity. The comparison is case-insensitive (strings.ToLower on both sides).","triggerScenarios":"Backend block's 'auth' attribute has a value that doesn't match any supported type (even after lowercasing). For example: auth=\"instance_principal\" (should be \"InstancePrincipal\"), auth=\"apikey\", auth=\"api-key\", or a completely wrong value.","commonSituations":"User wrote the auth type with underscores or hyphens instead of camelCase; user used a value from older documentation; user abbreviated the auth type; user expects environment-variable names (like OCI_CLI_AUTH) to work as auth values (e.g., auth=\"api_key\" which does NOT match 'APIKey' — the constant is AuthAPIKeySetting); typo in the auth string.","solutions":["Use the exact auth type value: one of 'APIKey', 'InstancePrincipal', 'InstancePrincipalWithCerts', 'SecurityToken', 'ResourcePrincipal', 'OKEWorkloadIdentity'.","Double-check spelling and casing — while comparison is case-insensitive, the compound words must be concatenated (no separators).","If unsure, omit 'auth' entirely to use the default (APIKey) or check the OCI backend documentation."],"exampleFix":"// before\nbackend \"oci\" {\n  auth = \"api_key\"  // wrong: should be \"APIKey\"\n}\n\n// after\nbackend \"oci\" {\n  auth = \"APIKey\"\n}","handlingStrategy":"validation","validationCode":"func validateAuthType(auth string) error {\n    valid := []string{\"APIKey\", \"InstancePrincipal\", \"InstancePrincipalWithCerts\", \"SecurityToken\", \"ResourcePrincipal\", \"OKEWorkloadIdentity\"}\n    lower := strings.ToLower(auth)\n    for _, v := range valid {\n        if lower == strings.ToLower(v) {\n            return nil\n        }\n    }\n    return fmt.Errorf(\"invalid auth type '%s': must be one of %v\", auth, valid)\n}","typeGuard":null,"tryCatchPattern":"// Validate auth type before terraform init:\nif err := validateAuthType(cfg.Auth); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Use the exact concatenated camelCase auth type names (APIKey, not api_key or api-key).","Document the valid auth types in your team's infrastructure standards.","Add a pre-flight validation step in CI to catch invalid auth values."],"tags":["oci","authentication","configuration","validation","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}