hashicorp/packer · error

unable to fetch project If the provided credentials are tie

Error message

unable to fetch project

If the provided credentials are tied to a specific project try setting the %s environment variable to one you want to use.

What it means

Raised when the project list API returns HTTP 403 (ProjectServiceListDefault with StatusForbidden), meaning the credentials' service principal cannot list all projects in the organization — typical for project-level service principals. The error explicitly instructs the user to set the HCP_PROJECT_ID environment variable so the client can target one project directly instead of listing. It is an intentional, actionable permission-error path.

Source

Thrown at internal/hcp/api/client.go:154

		}
		return nil
	}
	// Get the project using the organization ID.
	listProjParams := projectSvc.NewProjectServiceListParams()
	listProjParams.ScopeID = &c.OrganizationID
	scopeType := string(rmmodels.HashicorpCloudResourcemanagerResourceIDResourceTypeORGANIZATION)
	listProjParams.ScopeType = &scopeType
	listProjResp, err := c.Project.ProjectServiceList(listProjParams, nil)

	if err != nil {
		//For permission errors, our service principal may not have the ability
		// to see all projects for an Org; this is the case for project-level service principals.
		serviceErr, ok := err.(*projectSvc.ProjectServiceListDefault)
		if !ok {
			return fmt.Errorf("unable to fetch project list: %v", err)
		}
		if serviceErr.Code() == http.StatusForbidden {
			return fmt.Errorf("unable to fetch project\n\n"+
				"If the provided credentials are tied to a specific project try setting the %s environment variable to one you want to use.", env.HCPProjectID)
		}
	}

	if len(listProjResp.Payload.Projects) > 1 {
		log.Printf("[WARNING] Multiple HCP projects found, will pick the oldest one by default\n"+
			"To specify which project to use, set the %s environment variable to the one you want to use.", env.HCPProjectID)
	}

	proj, err := getOldestProject(listProjResp.Payload.Projects)
	if err != nil {
		return err
	}
	c.ProjectID = proj.ID
	return nil
}

// getOldestProject retrieves the oldest project from a list based on its created_at time.

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Set the HCP_PROJECT_ID environment variable to the project you want to use.
2. Alternatively use an organization-level service principal with permission to list projects.
3. Verify the service principal is bound to the project you expect in the HCP console.

Example fix

// before
// project-level service principal, no HCP_PROJECT_ID -> 403 on project list
// after
export HCP_PROJECT_ID="$(hcp projects list --id-only)"

if os.Getenv("HCP_PROJECT_ID") == "" && isProjectScopedPrincipal(clientID) {
    return fmt.Errorf("set %s for project-level service principals", "HCP_PROJECT_ID")
}

if err := client.ValidateRegistryForProject(); err != nil {
    var svcErr *projectSvc.ProjectServiceListDefault
    if errors.As(err, &svcErr) && svcErr.Code() == http.StatusForbidden {
        log.Println("Hint: set HCP_PROJECT_ID for project-scoped principals")
    }
    return err
}

When it happens

Trigger: ProjectServiceList in loadProjectID returns a *projectSvc.ProjectServiceListDefault whose Code() == http.StatusForbidden, i.e. the principal lacks org-wide project list permission.

Common situations: Using a project-scoped HCP service principal (which can only see its own project) without setting HCP_PROJECT_ID; org policies restricting project listing; wrong client credentials bound to a different project than intended.

Related errors

• error retrieving HCP Packer Version from HCP Packer Registry
• there is no HCP Packer Version associated with the channel %
• the HCP Packer Version associated with the channel %s is rev
• request GitHub OIDC token: unexpected status %s
• load KMS public key %q: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/4bb817d4314aeed9. Report an issue: GitHub.