{"record":{"id":"ff424007bddd1c75","repo":"hashicorp/terraform","slug":"unable-to-determine-region-from-terraform-backend","errorCode":null,"errorMessage":"unable to determine region from Terraform backend configuration while using Instance Principal","messagePattern":"unable to determine region from Terraform backend configuration while using Instance Principal","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":166,"sourceCode":"\t\t}\n\t\treturn common.PrivateKeyFromBytesWithPassword(pemFileContent, []byte(p.privateKeyPassword))\n\t}\n\n\treturn nil, fmt.Errorf(\"can not get private_key or private_key_path from Terraform configuration\")\n}\n\nfunc (p ociAuthConfigProvider) getConfigProviders() ([]common.ConfigurationProvider, error) {\n\tvar configProviders []common.ConfigurationProvider\n\tlogger := logWithOperation(\"AuthConfigProvider\")\n\tlogger.Debug(fmt.Sprintf(\"Using %s authentication\", p.authType))\n\tswitch strings.ToLower(p.authType) {\n\tcase strings.ToLower(AuthAPIKeySetting):\n\t\t// No additional config providers needed\n\tcase strings.ToLower(AuthInstancePrincipalSetting):\n\n\t\tlogger.Info(\"Attempting to authenticate using instance principal credentials\")\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"unable to determine region from Terraform backend configuration while using Instance Principal\")\n\t\t}\n\n\t\t// Used to modify InstancePrincipal auth clients so that `accept_local_certs` is honored for auth clients as well\n\t\tinstancePrincipalAuthClientModifier := func(client common.HTTPRequestDispatcher) (common.HTTPRequestDispatcher, error) {\n\t\t\tif acceptLocalCerts := getEnvSettingWithBlankDefault(AcceptLocalCerts); acceptLocalCerts != \"\" {\n\t\t\t\tif value, err := strconv.ParseBool(acceptLocalCerts); err == nil {\n\t\t\t\t\tmodifiedClient := buildHttpClient()\n\t\t\t\t\tmodifiedClient.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = value\n\t\t\t\t\treturn modifiedClient, nil\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn client, nil\n\t\t}\n\n\t\tcfg, err := auth.InstancePrincipalConfigurationForRegionWithCustomClient(common.StringToRegion(p.region), instancePrincipalAuthClientModifier)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L148-L184","documentation":"Returned inside getConfigProviders() when auth=\"InstancePrincipal\" but the 'region' field is empty. Instance principal authentication runs on an OCI compute instance and relies on the metadata service for credentials, but the region still must be explicitly provided because the SDK needs it to construct service endpoints.","triggerScenarios":"Backend block sets auth=\"InstancePrincipal\" but omits 'region'. Unlike API key auth where region can sometimes be inferred, instance principal requires region to be set explicitly in the backend config.","commonSituations":"User is on an OCI compute instance with a dynamic group and instance principal policy, set auth correctly, but forgot region in the backend block; user expects region to be auto-detected from instance metadata (it is not by this code path); region was previously in an env var that got unset.","solutions":["Add 'region' to the backend block (e.g., region = \"us-phoenix-1\").","Set the OCI_CLI_REGION / OCI_REGION environment variable as a fallback if the backend block is templated.","Verify the compute instance's dynamic group and policies allow object storage access for the chosen region."],"exampleFix":"// before\nbackend \"oci\" {\n  bucket    = \"my-state\"\n  namespace = \"mynamespace\"\n  auth      = \"InstancePrincipal\"\n}\n\n// after\nbackend \"oci\" {\n  bucket    = \"my-state\"\n  namespace = \"mynamespace\"\n  region    = \"us-phoenix-1\"\n  auth      = \"InstancePrincipal\"\n}","handlingStrategy":"validation","validationCode":"func validateOCIBackendConfig(cfg BackendConfig) error {\n    if strings.EqualFold(cfg.Auth, \"InstancePrincipal\") {\n        if cfg.Region == \"\" {\n            if os.Getenv(\"OCI_CLI_REGION\") == \"\" && os.Getenv(\"OCI_REGION\") == \"\" {\n                return fmt.Errorf(\"region is required for InstancePrincipal auth\")\n            }\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-init check:\nif err := validateOCIBackendConfig(backendCfg); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Always set region in the backend block, even for instance principal auth.","Set OCI_CLI_REGION as an environment variable fallback in CI.","Document that instance principal auth still requires explicit region."],"tags":["oci","authentication","configuration","instance-principal","region","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}