{"record":{"id":"fc6931db040c0774","repo":"hashicorp/terraform","slug":"unable-to-determine-region-from-terraform-backend-fc6931","errorCode":null,"errorMessage":"unable to determine region from Terraform backend configuration while using Instance Principal with certificates","messagePattern":"unable to determine region from Terraform backend configuration while using Instance Principal with certificates","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":192,"sourceCode":"\t\t\t\t\tmodifiedClient.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = value\n\t\t\t\t\treturn modifiedClient, nil\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn client, nil\n\t\t}\n\n\t\tcfg, err := auth.InstancePrincipalConfigurationForRegionWithCustomClient(common.StringToRegion(p.region), instancePrincipalAuthClientModifier)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tlogger.Debug(\" Configuration provided by: %s\", cfg)\n\n\t\tconfigProviders = append(configProviders, cfg)\n\tcase strings.ToLower(AuthInstancePrincipalWithCertsSetting):\n\t\tlogger.Info(\"Attempting to authenticate using instance principal with certificates\")\n\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"unable to determine region from Terraform backend configuration while using Instance Principal with certificates\")\n\t\t}\n\n\t\tdefaultCertsDir, err := os.Getwd()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not get working directory for current os platform\")\n\t\t}\n\n\t\tcertsDir := filepath.Clean(getEnvSettingWithDefault(\"test_certificates_location\", defaultCertsDir))\n\t\tleafCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf certificate from %s\", filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\t}\n\n\t\tleafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_key.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf private key from %s\", filepath.Join(certsDir, \"ip_key.pem\"))\n\t\t}\n","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L174-L210","documentation":"Returned inside getConfigProviders() when auth=\"InstancePrincipalWithCerts\" but 'region' is empty. This auth mode is used for testing with instance principal certificates from local files and, like regular instance principal, requires an explicit region to build the auth client.","triggerScenarios":"Backend block sets auth=\"InstancePrincipalWithCerts\" but omits 'region'. This is a test-oriented auth mode that reads certificate files from a local directory.","commonSituations":"Developer set up test certificates and the auth type for local integration testing but forgot region; this auth mode is rarely used in production and configuration examples are sparse.","solutions":["Add 'region' to the backend block.","Set the OCI_REGION environment variable as a fallback.","Confirm this auth mode is actually what you need — for production, use 'InstancePrincipal' (without certs); for testing, ensure test_certificates_location is also set."],"exampleFix":"// before\nbackend \"oci\" {\n  auth = \"InstancePrincipalWithCerts\"\n}\n\n// after\nbackend \"oci\" {\n  auth   = \"InstancePrincipalWithCerts\"\n  region = \"us-phoenix-1\"\n}","handlingStrategy":"validation","validationCode":"func validateOCIBackendConfig(cfg BackendConfig) error {\n    if strings.EqualFold(cfg.Auth, \"InstancePrincipalWithCerts\") {\n        if cfg.Region == \"\" {\n            return fmt.Errorf(\"region is required for InstancePrincipalWithCerts auth\")\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-init check:\nif err := validateOCIBackendConfig(backendCfg); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Set region explicitly for all auth modes that require it.","Reserve InstancePrincipalWithCerts for testing environments only.","Document test certificate requirements in your test setup guide."],"tags":["oci","authentication","configuration","instance-principal","certificates","region","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}