invalid provider matching pattern %q: hostname can be a wild

Error message

invalid provider matching pattern %q: hostname can be a wildcard only if both namespace and provider type are also wildcards

What it means

A wildcard hostname ("*" in the first segment) is only legal when both namespace and type are also wildcards — i.e. the only valid all-host form is "*/*/*". A pattern like "*/hashicorp/aws" is rejected because narrowing by host while wildcarding host alone is ambiguous.

Source

Thrown at internal/getproviders/multi_source.go:188

		}

		pType, err := normalizeProviderNameOrWildcard(parts[1])
		if err != nil {
			return nil, fmt.Errorf("invalid provider type %q in provider matching pattern %q: must either be the wildcard * or a provider type name", parts[1], str)
		}
		namespace, err := normalizeProviderNamespaceOrWildcard(parts[0])
		if err != nil {
			return nil, fmt.Errorf("invalid registry namespace %q in provider matching pattern %q: must either be the wildcard * or a literal namespace", parts[1], str)
		}

		ret[i] = addrs.Provider{
			Hostname:  host,
			Namespace: namespace,
			Type:      pType,
		}

		if ret[i].Hostname == svchost.Hostname(Wildcard) && !(ret[i].Namespace == Wildcard && ret[i].Type == Wildcard) {
			return nil, fmt.Errorf("invalid provider matching pattern %q: hostname can be a wildcard only if both namespace and provider type are also wildcards", str)
		}
		if ret[i].Namespace == Wildcard && ret[i].Type != Wildcard {
			return nil, fmt.Errorf("invalid provider matching pattern %q: namespace can be a wildcard only if the provider type is also a wildcard", str)
		}
	}
	return ret, nil
}

// CanHandleProvider returns true if and only if the given provider address
// is both included by the selector's include patterns and _not_ excluded
// by its exclude patterns.
//
// The absense of any include patterns is treated the same as a pattern
// that matches all addresses. Exclusions take priority over inclusions.
func (s MultiSourceSelector) CanHandleProvider(addr addrs.Provider) bool {
	switch {
	case s.Exclude.MatchesProvider(addr):
		return false

View on GitHub (pinned to c9def3e214)

Solutions

If you want all hosts, use "*/*/*" (matches everything).
Otherwise specify the concrete hostname: "registry.terraform.io/hashicorp/aws".
Drop the host segment entirely to default to the registry: "hashicorp/aws".

Example fix

# before
include = ["*/hashicorp/aws"]

# after
include = ["registry.terraform.io/hashicorp/aws"]
# or, to truly match all: ["*/*/*"]

Defensive patterns

Strategy: validation

Validate before calling

// Enforce: host wildcard implies namespace and type wildcards.
if len(parts) == 3 && parts[0] == "*" && !(parts[1] == "*" && parts[2] == "*") {
    return fmt.Errorf("hostname wildcard requires */*/*")
}

Prevention

Use "*/*/*" to match all hosts, never "*/ns/type".
Specify a concrete hostname when narrowing by namespace/type.
Drop the host segment to default to the registry.

When it happens

Trigger: Writing a three-segment pattern starting with "*" but with a concrete namespace and/or type, e.g. "*/hashicorp/aws" or "*/*/aws". The validator rejects the combination.

Common situations: Trying to say "any host, this namespace/type" in a mirror include rule; misunderstanding that host wildcard forces full wildcard.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/cbb4be9884610c89. Report an issue: GitHub.