{"record":{"id":"cfdf400ed1a112ae","repo":"hashicorp/terraform","slug":"failed-to-approve-use-of-state-storage-provider","errorCode":null,"errorMessage":"Failed to approve use of state storage provider: %s","messagePattern":"Failed to approve use of state storage provider: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/meta_backend.go","lineNumber":3235,"sourceCode":"\t\tId: fmt.Sprintf(\"approve-provider-%s-%s\", lock.Provider().Type, lock.Version()), // E.g. approve-provider-aws-4.0.0. This needs to be unique in case the command needs approval for >1 provider.\n\t\tQuery: fmt.Sprintf(`Do you want to use provider %q (%s), version %s, for managing state?\nPlatform: %s\nAuthentication: %s\nHashes:\n%s\n`,\n\t\t\tlock.Provider().Type,\n\t\t\tlock.Provider(),\n\t\t\tlock.Version(),\n\t\t\tgetproviders.CurrentPlatform.String(),\n\t\t\tauthentication,\n\t\t\thashList.String(),\n\t\t),\n\t\tDescription: fmt.Sprintf(`Check the details above for provider %q and confirm that you trust the provider.\n\tOnly 'yes' will be accepted to confirm.`, lock.Provider().Type),\n\t})\n\tif err != nil {\n\t\treturn diags.Append(fmt.Errorf(\"Failed to approve use of state storage provider: %s\", err))\n\t}\n\tif v != \"yes\" {\n\t\treturn diags.Append(\n\t\t\tfmt.Errorf(\"State store provider %q (%s) was not approved, so init cannot continue.\",\n\t\t\t\tlock.Provider().Type,\n\t\t\t\tlock.Provider(),\n\t\t\t),\n\t\t)\n\t}\n\treturn diags\n}\n\n//-------------------------------------------------------------------\n// Output constants and initialization code\n//-------------------------------------------------------------------\n\nconst inputCloudInitCreateWorkspace = `\nThere are no workspaces with the configured tags (%s)","sourceCodeStart":3217,"sourceCodeEnd":3253,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/meta_backend.go#L3217-L3253","documentation":"In Meta.promptStateStorageProviderApproval (meta_backend.go:3235), Terraform prompts the user to explicitly approve trusting a state-storage provider (showing its type, version, platform, authentication result, and hashes). It calls m.UIInput().Input(); if that input call itself errors (no TTY, EOF, closed stdin, UI failure), this wraps it. This is a failure of the prompting mechanism, distinct from a user declining.","triggerScenarios":"Running `terraform init` with a new state_store provider in a non-interactive context where the approval prompt cannot be displayed/answered; stdin closed or not a terminal; a UI input implementation returning an error.","commonSituations":"CI/containers with no TTY on first use of a state-store provider; scripts piping into terraform; headless automation that has not pre-approved/trusted the provider.","solutions":["Run with `-input=false` and pre-establish trust (e.g. via provider mirror + lock file, or the trust mechanism Terraform provides) so the approval prompt is bypassed.","Run init once in an interactive shell to approve the provider, committing the resulting lock file for CI reuse.","Ensure a TTY/PTY is attached if you intend to answer the prompt.","Inspect the wrapped `%s` for the underlying input error (EOF, not a terminal)."],"exampleFix":"// before: terraform init   (CI, no TTY; fails: Failed to approve use of state storage provider)\n// after: # approve once locally, commit .terraform.lock.hcl, then in CI:\nterraform init -input=false","handlingStrategy":"validation","validationCode":"// In non-interactive contexts, avoid the approval prompt by pre-establishing trust.\nfunc stateStoreProviderPreapproved(inputEnabled bool, lockHasProvider bool) error {\n    if !inputEnabled && !lockHasProvider {\n        return fmt.Errorf(\"no TTY and provider not pre-approved; run init interactively first\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Approve a new state-store provider once in an interactive shell and commit the lock file.","Run CI with `-input=false` after establishing trust locally.","Verify provider hashes in the lock file before approving.","Avoid running first-time provider approval in headless automation."],"tags":["state-store","provider","input","interactive","trust","ci"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}