hashicorp/terraform · error

can not get %s from Terraform backend configuration

Error message

can not get %s from Terraform backend configuration

What it means

The OCI backend's API-key configuration provider needs the tenancy OCID to sign requests. TenancyOCID() returns the configured value if present, otherwise this error naming the missing attribute `tenancy_ocid`. It surfaces when the SDK's request signer (KeyID) asks for the tenancy and neither the backend config nor a downstream provider supplied it.

Source

Thrown at internal/backend/remote-state/oci/auth.go:95

		p.privateKeyPassword = privateKeyPasswordVal.AsString()
	}

	return p
}
func (p ociAuthConfigProvider) AuthType() (common.AuthConfig, error) {
	return common.AuthConfig{
			AuthType:         common.UnknownAuthenticationType,
			IsFromConfigFile: false,
			OboToken:         nil,
		},
		fmt.Errorf("unsupported, keep the interface")
}

func (p ociAuthConfigProvider) TenancyOCID() (string, error) {
	if p.tenancyOcid != "" {
		return p.tenancyOcid, nil
	}
	return "", fmt.Errorf("can not get %s from Terraform backend configuration", TenancyOcidAttrName)
}

func (p ociAuthConfigProvider) UserOCID() (string, error) {
	if p.userOcid != "" {
		return p.userOcid, nil
	}
	return "", fmt.Errorf("can not get %s from Terraform backend configuration", UserOcidAttrName)
}

func (p ociAuthConfigProvider) KeyFingerprint() (string, error) {
	if p.fingerprint != "" {
		return p.fingerprint, nil
	}
	return "", fmt.Errorf("can not get %s from Terraform backend configuration", FingerprintAttrName)
}

func (p ociAuthConfigProvider) Region() (string, error) {
	if p.region != "" {

View on GitHub (pinned to c9def3e214)

Solutions

1. Add `tenancy_ocid` to the backend block with the full tenancy OCID (e.g. ocid1.tenancy.oc1.....).
2. If using config_file_profile, ensure the referenced profile contains tenancy in ~/.oci/config.
3. Validate the OCID format and that it matches the tenancy of the user/fingerprint/key.

Example fix

# before - tenancy_ocid missing
terraform {
  backend "oci" {
    namespace   = "my-namespace"
    bucket      = "tfstate"
    region      = "us-phoenix-1"
    user_ocid   = "ocid1.user.oc1..aaa"
    fingerprint = "12:34:..."
  }
}

# after - include tenancy_ocid
terraform {
  backend "oci" {
    namespace    = "my-namespace"
    bucket       = "tfstate"
    region       = "us-phoenix-1"
    tenancy_ocid = "ocid1.tenancy.oc1..aaa"
    user_ocid    = "ocid1.user.oc1..aaa"
    fingerprint  = "12:34:..."
  }
}

// Ensure required OCI API-key attributes are set before configuring
required := []string{"tenancy_ocid", "user_ocid", "fingerprint", "region"}
for _, k := range required {
    if v, ok := getBackendAttr(cfg, k); !ok || v.AsString() == "" {
        return fmt.Errorf("missing required OCI backend attribute: %s", k)
    }
}

When it happens

Trigger: Using the OCI backend with auth=APIKey (the default) where the tenancy_ocid attribute is unset, and the SDK CompositeConfigurationProvider falls through all providers to this raw one returning the error from TenancyOCID() at auth.go:91-96.

Common situations: Backend config block missing tenancy_ocid entirely; relying on a config_file_profile that itself lacks tenancy; typos in the attribute name; copy-paste from a provider block that used a different key.

Related errors

• Failed to configure: %s
• secret_suffix must not end with '-<number>', got %q
• Failed to initialize kubernetes configuration: %s
• configuration file did not contain profile: %s
• sasToken cannot be empty

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/6d5ffd8a7ac9e6db. Report an issue: GitHub.