{"record":{"id":"fe89650ff7c8a873","repo":"hashicorp/terraform","slug":"provider-s-required-by-this-configuration-but-no","errorCode":null,"errorMessage":"provider %s: required by this configuration but no version is selected","messagePattern":"provider (.+?): required by this configuration but no version is selected","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configs/config.go","lineNumber":293,"sourceCode":"\t\tif !depsfile.ProviderIsLockable(providerAddr) {\n\t\t\tcontinue // disregard builtin providers, and such\n\t\t}\n\t\tif depLocks != nil && depLocks.ProviderIsOverridden(providerAddr) {\n\t\t\t// The \"overridden\" case is for unusual special situations like\n\t\t\t// dev overrides, so we'll explicitly note it in the logs just in\n\t\t\t// case we see bug reports with these active and it helps us\n\t\t\t// understand why we ended up using the \"wrong\" plugin.\n\t\t\tlog.Printf(\"[DEBUG] Config.VerifyDependencySelections: skipping %s because it's overridden by a special configuration setting\", providerAddr)\n\t\t\tcontinue\n\t\t}\n\n\t\tvar lock *depsfile.ProviderLock\n\t\tif depLocks != nil { // Should always be true in main code, but unfortunately sometimes not true in old tests that don't fill out arguments completely\n\t\t\tlock = depLocks.Provider(providerAddr)\n\t\t}\n\t\tif lock == nil {\n\t\t\tlog.Printf(\"[TRACE] Config.VerifyDependencySelections: provider %s has no lock file entry to satisfy %q\", providerAddr, providerreqs.VersionConstraintsString(constraints))\n\t\t\terrs = append(errs, fmt.Errorf(\"provider %s: required by this configuration but no version is selected\", providerAddr))\n\t\t\tcontinue\n\t\t}\n\n\t\tselectedVersion := lock.Version()\n\t\tallowedVersions := providerreqs.MeetingConstraints(constraints)\n\t\tlog.Printf(\"[TRACE] Config.VerifyDependencySelections: provider %s has %s to satisfy %q\", providerAddr, selectedVersion.String(), providerreqs.VersionConstraintsString(constraints))\n\t\tif !allowedVersions.Has(selectedVersion) {\n\t\t\t// The most likely cause of this is that the author of a module\n\t\t\t// has changed its constraints, but this could also happen in\n\t\t\t// some other unusual situations, such as the user directly\n\t\t\t// editing the lock file to record something invalid. We'll\n\t\t\t// distinguish those cases here in order to avoid the more\n\t\t\t// specific error message potentially being a red herring in\n\t\t\t// the edge-cases.\n\t\t\tcurrentConstraints := providerreqs.VersionConstraintsString(constraints)\n\t\t\tlockedConstraints := providerreqs.VersionConstraintsString(lock.VersionConstraints())\n\t\t\tswitch {\n\t\t\tcase currentConstraints != lockedConstraints:","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/configs/config.go#L275-L311","documentation":"Raised when a provider is referenced by the configuration but has no entry in the dependency lock file (.terraform.lock.hcl). VerifyDependencySelections iterates ProviderRequirements and, for each lockable provider, looks up depLocks.Provider(addr); a nil result (line 291) means init never recorded a selected version. This is the canonical 'you forgot to terraform init' / 'lock file is incomplete' signal.","triggerScenarios":"Adding a resource from a provider not yet installed, deleting .terraform.lock.hcl or .terraform/, switching to a module that introduces a new provider, or running plan/apply on a fresh clone without init. Providers marked overridden (dev overrides) are skipped, so this only fires for genuinely un-locked providers.","commonSituations":"Fresh CI checkout missing the .terraform directory, a teammate added an aws resource but didn't commit the lock update, a custom/local provider address that init skipped, or .terraform.lock.hcl gitignored.","solutions":["Run `terraform init` to install the provider and write its lock entry.","If using a custom registry or local filesystem mirror, confirm the provider is reachable: `terraform providers lock -platform=linux_amd64`.","Verify .terraform.lock.hcl is committed and not gitignored; if deleted, restore it and re-run init.","Check for typos in the provider source address in required_providers."],"exampleFix":"// before: plan fails with \"provider hashicorp/aws: required ... no version is selected\"\n\n// after\n$ terraform init","handlingStrategy":"validation","validationCode":"// Gate plan/apply behind a successful `terraform init` step, then assert the lock\n// file lists every provider returned by `terraform providers`.\n// In Go: read .terraform.lock.hcl and confirm each required provider address has an entry.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always commit .terraform.lock.hcl (do not gitignore it).","Run terraform init as the first step of every CI job.","Add new providers via `terraform init` so the lock entry is written automatically."],"tags":["config","provider-dependencies","lock-file","init"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}