hashicorp/terraform · error

auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or

Error message

auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or '%s'

What it means

Returned by the default case of the switch statement in getConfigProviders() when the 'auth' value does not match any of the supported authentication types: APIKey, InstancePrincipal, InstancePrincipalWithCerts, SecurityToken, ResourcePrincipal, or OKEWorkloadIdentity. The comparison is case-insensitive (strings.ToLower on both sides).

Source

Thrown at internal/backend/remote-state/oci/auth.go:281

		if p.region == "" {
			logger.Debug("did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable", RegionAttrName)
			resourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProvider()
		} else {
			resourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProviderForRegion(common.StringToRegion(p.region))
		}
		if err != nil {
			return nil, err
		}
		configProviders = append(configProviders, resourcePrincipalAuthConfigProvider)
	case strings.ToLower(AuthOKEWorkloadIdentity):
		logger.Info("Attempting to authenticate using OKE workload identity")
		okeWorkloadIdentityConfigProvider, err := auth.OkeWorkloadIdentityConfigurationProvider()
		if err != nil {
			return nil, fmt.Errorf("can not get oke workload indentity based auth config provider %v", err)
		}
		configProviders = append(configProviders, okeWorkloadIdentityConfigProvider)
	default:
		return nil, fmt.Errorf("auth must be one of '%s' or '%s' or '%s' or '%s' or '%s' or '%s'", AuthAPIKeySetting, AuthInstancePrincipalSetting, AuthInstancePrincipalWithCertsSetting, AuthSecurityToken, ResourcePrincipal, AuthOKEWorkloadIdentity)
	}

	return configProviders, nil
}
func (p ociAuthConfigProvider) getSdkConfigProvider() (common.ConfigurationProvider, error) {

	configProviders, err := p.getConfigProviders()
	if err != nil {
		return nil, err
	}

	configProviders = append(configProviders, p)
	//In GoSDK, the first step is to check if AuthType exists,
	//for composite provider, we only check the first provider in the list for the AuthType.
	//Then SDK will based on the AuthType to Create the actual provider if it's a valid value.
	//If not, then SDK will base on the order in the composite provider list to check for necessary info (tenancyid, userID, fingerprint, region, keyID).
	if p.configFileProfile == "" {
		configProviders = append(configProviders, common.DefaultConfigProvider())

View on GitHub (pinned to d32a084675)

Solutions

1. Use the exact auth type value: one of 'APIKey', 'InstancePrincipal', 'InstancePrincipalWithCerts', 'SecurityToken', 'ResourcePrincipal', 'OKEWorkloadIdentity'.
2. Double-check spelling and casing — while comparison is case-insensitive, the compound words must be concatenated (no separators).
3. If unsure, omit 'auth' entirely to use the default (APIKey) or check the OCI backend documentation.

Example fix

// before
backend "oci" {
  auth = "api_key"  // wrong: should be "APIKey"
}

// after
backend "oci" {
  auth = "APIKey"
}

func validateAuthType(auth string) error {
    valid := []string{"APIKey", "InstancePrincipal", "InstancePrincipalWithCerts", "SecurityToken", "ResourcePrincipal", "OKEWorkloadIdentity"}
    lower := strings.ToLower(auth)
    for _, v := range valid {
        if lower == strings.ToLower(v) {
            return nil
        }
    }
    return fmt.Errorf("invalid auth type '%s': must be one of %v", auth, valid)
}

// Validate auth type before terraform init:
if err := validateAuthType(cfg.Auth); err != nil {
    log.Fatal(err)
}

When it happens

Trigger: Backend block's 'auth' attribute has a value that doesn't match any supported type (even after lowercasing). For example: auth="instance_principal" (should be "InstancePrincipal"), auth="apikey", auth="api-key", or a completely wrong value.

Common situations: User wrote the auth type with underscores or hyphens instead of camelCase; user used a value from older documentation; user abbreviated the auth type; user expects environment-variable names (like OCI_CLI_AUTH) to work as auth values (e.g., auth="api_key" which does NOT match 'APIKey' — the constant is AuthAPIKeySetting); typo in the auth string.

Related errors

• One of `access_key`, `sas_token`, `use_azuread_auth` and `re
• can not get private_key or private_key_path from Terraform c
• unable to determine region from Terraform backend configurat
• unable to determine region from Terraform backend configurat
• can not get %s from Terraform configuration (SecurityToken)

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/c69992e29b0cea02. Report an issue: GitHub.