could not create security token based auth config provider %

Error message

could not create security token based auth config provider %v

What it means

Returned when common.ConfigurationProviderForSessionTokenWithProfile() fails to create a security token-based auth config provider. This wraps the underlying OCI SDK error, which can be caused by a malformed or unreadable config file, a missing security token, an invalid/expired token, or a missing private key passphrase.

Source

Thrown at internal/backend/remote-state/oci/auth.go:255

		logger.Info("Attempting to authenticate using security token")
		if p.region == "" {
			return nil, fmt.Errorf("can not get %s from Terraform configuration (SecurityToken)", RegionAttrName)
		}
		// if region is part of the provider block make sure it is part of the final configuration too, and overwrites the region in the profile. +
		regionProvider := common.NewRawConfigurationProvider("", "", p.region, "", "", nil)
		configProviders = append(configProviders, regionProvider)

		if p.configFileProfile == "" {
			return nil, fmt.Errorf("missing profile in provider block %v", ConfigFileProfileAttrName)
		}

		defaultPath := path.Join(getHomeFolder(), DefaultConfigDirName, DefaultConfigFileName)
		if err := checkProfile(p.configFileProfile, defaultPath); err != nil {
			return nil, err
		}
		securityTokenBasedAuthConfigProvider, err := common.ConfigurationProviderForSessionTokenWithProfile(defaultPath, p.configFileProfile, p.privateKeyPassword)
		if err != nil {
			return nil, fmt.Errorf("could not create security token based auth config provider %v", err)
		}
		configProviders = append(configProviders, securityTokenBasedAuthConfigProvider)
	case strings.ToLower(ResourcePrincipal):
		logger.Info("Attempting to authenticate using resource principal credentials")
		var err error
		var resourcePrincipalAuthConfigProvider auth.ConfigurationProviderWithClaimAccess

		if p.region == "" {
			logger.Debug("did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable", RegionAttrName)
			resourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProvider()
		} else {
			resourcePrincipalAuthConfigProvider, err = auth.ResourcePrincipalConfigurationProviderForRegion(common.StringToRegion(p.region))
		}
		if err != nil {
			return nil, err
		}
		configProviders = append(configProviders, resourcePrincipalAuthConfigProvider)
	case strings.ToLower(AuthOKEWorkloadIdentity):

View on GitHub (pinned to d32a084675)

Solutions

Check the full wrapped error (the %v) for the underlying SDK cause — it indicates whether it's a file issue, token issue, or password issue.
Regenerate the security token using 'oci session authenticate' if the token has expired.
Verify the config file profile at ~/.oci/config is well-formed and all referenced files exist.
If using a passphrase-protected key, ensure private_key_password in the backend block matches.
Validate the profile with: oci iam region list --profile <profile> --auth security_token.

Example fix

// before
backend "oci" {
  auth               = "SecurityToken"
  region             = "us-phoenix-1"
  config_file_profile = "myprofile"
}
// token expired

// after
oci session authenticate --profile-name myprofile --tenant-id ocid1.tenancy... --region us-phoenix-1
terraform init

Defensive patterns

Strategy: try-catch

Validate before calling

func validateSecurityTokenProfile(profile, configPath string) error {
    // Check config file exists and is parseable
    if _, err := os.Stat(configPath); err != nil {
        return fmt.Errorf("OCI config file not found: %w", err)
    }
    // Check profile has required fields
    cmd := exec.Command("oci", "iam", "region", "list",
        "--profile", profile, "--auth", "security_token")
    if err := cmd.Run(); err != nil {
        return fmt.Errorf("security token validation failed (token may be expired): %w", err)
    }
    return nil
}

Try / catch

// Validate before terraform init:
configPath := filepath.Join(getHomeFolder(), ".oci", "config")
if err := validateSecurityTokenProfile(cfg.ConfigFileProfile, configPath); err != nil {
    // Common fix: regenerate token
    log.Printf("security token invalid: %v — run: oci session authenticate", err)
    log.Fatal(err)
}

Prevention

Security tokens are short-lived — set up automated refresh before expiry.
Use 'oci session authenticate' to generate tokens and document the refresh process.
Validate the profile with OCI CLI before running terraform.

When it happens

Trigger: auth="SecurityToken" with config_file_profile set, but the profile in ~/.oci/config is malformed, the security_token field is missing or expired, the key file referenced by the profile doesn't exist, or the private key password is wrong.

Common situations: Security token expired (tokens are short-lived and need periodic rotation); config file has a typo in the profile section; key_file path in the profile is wrong; private_key_password in the backend block doesn't match the key; profile references a security_token_file that doesn't exist.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/db40265ab3e0514d. Report an issue: GitHub.