What causes "Failed to approve use of state storage provider: %s" in hashicorp/terraform?

Run with `-input=false` and pre-establish trust (e.g. via provider mirror + lock file, or the trust mechanism Terraform provides) so the approval prompt is bypassed.

hashicorp/terraform · error

Failed to approve use of state storage provider: %s

Error message

Failed to approve use of state storage provider: %s

What it means

In Meta.promptStateStorageProviderApproval (meta_backend.go:3235), Terraform prompts the user to explicitly approve trusting a state-storage provider (showing its type, version, platform, authentication result, and hashes). It calls m.UIInput().Input(); if that input call itself errors (no TTY, EOF, closed stdin, UI failure), this wraps it. This is a failure of the prompting mechanism, distinct from a user declining.

Source

Thrown at internal/command/meta_backend.go:3235

		Id: fmt.Sprintf("approve-provider-%s-%s", lock.Provider().Type, lock.Version()), // E.g. approve-provider-aws-4.0.0. This needs to be unique in case the command needs approval for >1 provider.
		Query: fmt.Sprintf(`Do you want to use provider %q (%s), version %s, for managing state?
Platform: %s
Authentication: %s
Hashes:
%s
`,
			lock.Provider().Type,
			lock.Provider(),
			lock.Version(),
			getproviders.CurrentPlatform.String(),
			authentication,
			hashList.String(),
		),
		Description: fmt.Sprintf(`Check the details above for provider %q and confirm that you trust the provider.
	Only 'yes' will be accepted to confirm.`, lock.Provider().Type),
	})
	if err != nil {
		return diags.Append(fmt.Errorf("Failed to approve use of state storage provider: %s", err))
	}
	if v != "yes" {
		return diags.Append(
			fmt.Errorf("State store provider %q (%s) was not approved, so init cannot continue.",
				lock.Provider().Type,
				lock.Provider(),
			),
		)
	}
	return diags
}

//-------------------------------------------------------------------
// Output constants and initialization code
//-------------------------------------------------------------------

const inputCloudInitCreateWorkspace = `
There are no workspaces with the configured tags (%s)

View on GitHub (pinned to c9def3e214)

Solutions

Run with `-input=false` and pre-establish trust (e.g. via provider mirror + lock file, or the trust mechanism Terraform provides) so the approval prompt is bypassed.
Run init once in an interactive shell to approve the provider, committing the resulting lock file for CI reuse.
Ensure a TTY/PTY is attached if you intend to answer the prompt.
Inspect the wrapped `%s` for the underlying input error (EOF, not a terminal).

Example fix

// before: terraform init   (CI, no TTY; fails: Failed to approve use of state storage provider)
// after: # approve once locally, commit .terraform.lock.hcl, then in CI:
terraform init -input=false

Defensive patterns

Strategy: validation

Validate before calling

// In non-interactive contexts, avoid the approval prompt by pre-establishing trust.
func stateStoreProviderPreapproved(inputEnabled bool, lockHasProvider bool) error {
    if !inputEnabled && !lockHasProvider {
        return fmt.Errorf("no TTY and provider not pre-approved; run init interactively first")
    }
    return nil
}

Prevention

Approve a new state-store provider once in an interactive shell and commit the lock file.
Run CI with `-input=false` after establishing trust locally.
Verify provider hashes in the lock file before approving.
Avoid running first-time provider approval in headless automation.

When it happens

Trigger: Running `terraform init` with a new state_store provider in a non-interactive context where the approval prompt cannot be displayed/answered; stdin closed or not a terminal; a UI input implementation returning an error.

Common situations: CI/containers with no TTY on first use of a state-store provider; scripts piping into terraform; headless automation that has not pre-approved/trusted the provider.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/cfdf400ed1a112ae. Report an issue: GitHub.