What causes "connection type '%s' not supported" in hashicorp/terraform?

Use 'ssh' for Linux/Unix targets or 'winrm' for Windows targets.

connection type '%s' not supported

Error message

connection type '%s' not supported

What it means

communicator.New at communicator.go:52 dispatches on the connection block's 'type' attribute. Only 'ssh' (also the default when type is empty, per line 65) and 'winrm' are implemented. Any other value falls through to the default case at communicator.go:70.

Source

Thrown at internal/communicator/communicator.go:70

func New(v cty.Value) (Communicator, error) {
	v, err := shared.ConnectionBlockSupersetSchema.CoerceValue(v)
	if err != nil {
		return nil, err
	}

	typeVal := v.GetAttr("type")
	connType := ""
	if !typeVal.IsNull() {
		connType = typeVal.AsString()
	}

	switch connType {
	case "ssh", "": // The default connection type is ssh, so if connType is empty use ssh
		return ssh.New(v)
	case "winrm":
		return winrm.New(v)
	default:
		return nil, fmt.Errorf("connection type '%s' not supported", connType)
	}
}

// maxBackoffDelay is the maximum delay between retry attempts
var maxBackoffDelay = 20 * time.Second
var initialBackoffDelay = time.Second

// in practice we want to abort the retry asap, but for tests we need to
// synchronize the return.
var retryTestWg *sync.WaitGroup

// Fatal is an interface that error values can return to halt Retry
type Fatal interface {
	FatalError() error
}

// Retry retries the function f until it returns a nil error, a Fatal error, or
// the context expires.

View on GitHub (pinned to c9def3e214)

Solutions

Use 'ssh' for Linux/Unix targets or 'winrm' for Windows targets.
Omit 'type' entirely to get the default (ssh).
Re-check the connection block inside your provisioner/resource for the typo.

Example fix

// before
connection {
  type     = "shh"   // typo
  user     = "ubuntu"
  host     = aws_instance.web.public_ip
}
Error: connection type 'shh' not supported

// after
connection {
  type     = "ssh"
  user     = "ubuntu"
  host     = aws_instance.web.public_ip
}

Defensive patterns

Strategy: validation

Validate before calling

// Validate the connection type before constructing the communicator.
func isValidConnType(t string) bool {
    switch t {
    case "", "ssh", "winrm":
        return true
    }
    return false
}
if !isValidConnType(connType) {
    return fmt.Errorf("unsupported connection type %q (use ssh or winrm)", connType)
}

Type guard

null

Try / catch

null

Prevention

Document and lint connection block types to ssh/winrm only.
Omit 'type' to default to ssh and avoid typos.
Add a config validator for provisioner connection blocks.

When it happens

Trigger: A provisioner connection block specifies type = "telnet" (or any value other than ssh/winrm/empty).

Common situations: Typo in the connection type; assuming a connector (e.g. 'docker', 'local') exists when it doesn't; copy-pasting a connection block from an unsupported example.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/2c9fcf4f37495d95. Report an issue: GitHub.