{"record":{"id":"db40265ab3e0514d","repo":"hashicorp/terraform","slug":"could-not-create-security-token-based-auth-config","errorCode":null,"errorMessage":"could not create security token based auth config provider %v","messagePattern":"could not create security token based auth config provider (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":255,"sourceCode":"\t\tlogger.Info(\"Attempting to authenticate using security token\")\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"can not get %s from Terraform configuration (SecurityToken)\", RegionAttrName)\n\t\t}\n\t\t// if region is part of the provider block make sure it is part of the final configuration too, and overwrites the region in the profile. +\n\t\tregionProvider := common.NewRawConfigurationProvider(\"\", \"\", p.region, \"\", \"\", nil)\n\t\tconfigProviders = append(configProviders, regionProvider)\n\n\t\tif p.configFileProfile == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"missing profile in provider block %v\", ConfigFileProfileAttrName)\n\t\t}\n\n\t\tdefaultPath := path.Join(getHomeFolder(), DefaultConfigDirName, DefaultConfigFileName)\n\t\tif err := checkProfile(p.configFileProfile, defaultPath); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tsecurityTokenBasedAuthConfigProvider, err := common.ConfigurationProviderForSessionTokenWithProfile(defaultPath, p.configFileProfile, p.privateKeyPassword)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not create security token based auth config provider %v\", err)\n\t\t}\n\t\tconfigProviders = append(configProviders, securityTokenBasedAuthConfigProvider)\n\tcase strings.ToLower(ResourcePrincipal):\n\t\tlogger.Info(\"Attempting to authenticate using resource principal credentials\")\n\t\tvar err error\n\t\tvar resourcePrincipalAuthConfigProvider auth.ConfigurationProviderWithClaimAccess\n\n\t\tif p.region == \"\" {\n\t\t\tlogger.Debug(\"did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable\", RegionAttrName)\n\t\t\tresourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProvider()\n\t\t} else {\n\t\t\tresourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProviderForRegion(common.StringToRegion(p.region))\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tconfigProviders = append(configProviders, resourcePrincipalAuthConfigProvider)\n\tcase strings.ToLower(AuthOKEWorkloadIdentity):","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L237-L273","documentation":"Returned when common.ConfigurationProviderForSessionTokenWithProfile() fails to create a security token-based auth config provider. This wraps the underlying OCI SDK error, which can be caused by a malformed or unreadable config file, a missing security token, an invalid/expired token, or a missing private key passphrase.","triggerScenarios":"auth=\"SecurityToken\" with config_file_profile set, but the profile in ~/.oci/config is malformed, the security_token field is missing or expired, the key file referenced by the profile doesn't exist, or the private key password is wrong.","commonSituations":"Security token expired (tokens are short-lived and need periodic rotation); config file has a typo in the profile section; key_file path in the profile is wrong; private_key_password in the backend block doesn't match the key; profile references a security_token_file that doesn't exist.","solutions":["Check the full wrapped error (the %v) for the underlying SDK cause — it indicates whether it's a file issue, token issue, or password issue.","Regenerate the security token using 'oci session authenticate' if the token has expired.","Verify the config file profile at ~/.oci/config is well-formed and all referenced files exist.","If using a passphrase-protected key, ensure private_key_password in the backend block matches.","Validate the profile with: oci iam region list --profile <profile> --auth security_token."],"exampleFix":"// before\nbackend \"oci\" {\n  auth               = \"SecurityToken\"\n  region             = \"us-phoenix-1\"\n  config_file_profile = \"myprofile\"\n}\n// token expired\n\n// after\noci session authenticate --profile-name myprofile --tenant-id ocid1.tenancy... --region us-phoenix-1\nterraform init","handlingStrategy":"try-catch","validationCode":"func validateSecurityTokenProfile(profile, configPath string) error {\n    // Check config file exists and is parseable\n    if _, err := os.Stat(configPath); err != nil {\n        return fmt.Errorf(\"OCI config file not found: %w\", err)\n    }\n    // Check profile has required fields\n    cmd := exec.Command(\"oci\", \"iam\", \"region\", \"list\",\n        \"--profile\", profile, \"--auth\", \"security_token\")\n    if err := cmd.Run(); err != nil {\n        return fmt.Errorf(\"security token validation failed (token may be expired): %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Validate before terraform init:\nconfigPath := filepath.Join(getHomeFolder(), \".oci\", \"config\")\nif err := validateSecurityTokenProfile(cfg.ConfigFileProfile, configPath); err != nil {\n    // Common fix: regenerate token\n    log.Printf(\"security token invalid: %v — run: oci session authenticate\", err)\n    log.Fatal(err)\n}","preventionTips":["Security tokens are short-lived — set up automated refresh before expiry.","Use 'oci session authenticate' to generate tokens and document the refresh process.","Validate the profile with OCI CLI before running terraform."],"tags":["oci","authentication","security-token","session-token","profile","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}