can not get %s from Terraform configuration (SecurityToken)

Error message

can not get %s from Terraform configuration (SecurityToken)

What it means

Returned inside getConfigProviders() when auth="SecurityToken" but 'region' is empty. Security token authentication reads credentials from an OCI config file profile, but the region still must be set (either in the backend block or resolved from the profile). The backend explicitly checks for region before proceeding.

Source

Thrown at internal/backend/remote-state/oci/auth.go:239

			return nil, fmt.Errorf("can not read intermediate certificate from %s", filepath.Join(certsDir, "intermediate.pem"))
		}

		intermediateCertificatesBytes := [][]byte{
			intermediateCertificateBytes,
		}

		cfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)
		if err != nil {
			return nil, err
		}
		logger.Debug(" Configuration provided by: %s", cfg)

		configProviders = append(configProviders, cfg)

	case strings.ToLower(AuthSecurityToken):
		logger.Info("Attempting to authenticate using security token")
		if p.region == "" {
			return nil, fmt.Errorf("can not get %s from Terraform configuration (SecurityToken)", RegionAttrName)
		}
		// if region is part of the provider block make sure it is part of the final configuration too, and overwrites the region in the profile. +
		regionProvider := common.NewRawConfigurationProvider("", "", p.region, "", "", nil)
		configProviders = append(configProviders, regionProvider)

		if p.configFileProfile == "" {
			return nil, fmt.Errorf("missing profile in provider block %v", ConfigFileProfileAttrName)
		}

		defaultPath := path.Join(getHomeFolder(), DefaultConfigDirName, DefaultConfigFileName)
		if err := checkProfile(p.configFileProfile, defaultPath); err != nil {
			return nil, err
		}
		securityTokenBasedAuthConfigProvider, err := common.ConfigurationProviderForSessionTokenWithProfile(defaultPath, p.configFileProfile, p.privateKeyPassword)
		if err != nil {
			return nil, fmt.Errorf("could not create security token based auth config provider %v", err)
		}
		configProviders = append(configProviders, securityTokenBasedAuthConfigProvider)

View on GitHub (pinned to d32a084675)

Solutions

Add 'region' to the backend block (e.g., region = "us-phoenix-1").
Set the OCI_CLI_REGION / OCI_REGION environment variable.
Verify the config file profile has a region entry, though the backend block's region takes precedence.

Example fix

// before
backend "oci" {
  auth               = "SecurityToken"
  config_file_profile = "DEFAULT"
}

// after
backend "oci" {
  auth               = "SecurityToken"
  config_file_profile = "DEFAULT"
  region              = "us-phoenix-1"
}

Defensive patterns

Strategy: validation

Validate before calling

func validateOCIBackendConfig(cfg BackendConfig) error {
    if strings.EqualFold(cfg.Auth, "SecurityToken") {
        if cfg.Region == "" {
            return fmt.Errorf("region is required for SecurityToken auth")
        }
        if cfg.ConfigFileProfile == "" {
            return fmt.Errorf("config_file_profile is required for SecurityToken auth")
        }
    }
    return nil
}

Try / catch

// Pre-init validation:
if err := validateOCIBackendConfig(backendCfg); err != nil {
    log.Fatal(err)
}

Prevention

Always set region explicitly for SecurityToken auth.
Verify the OCI config file profile has a region entry.
Use OCI_CLI_REGION as a fallback environment variable.

When it happens

Trigger: Backend block sets auth="SecurityToken" but omits 'region', and the region is not resolvable from the config file profile path at this check point.

Common situations: User switched from API key to security token auth but forgot to add region; user expects the config file profile to supply region but the backend block's empty region check fails first; config_file_profile is set but the check for region happens before profile loading.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/33ba05929374198c. Report an issue: GitHub.