invalid provider matching pattern %q: namespace can be a wil

Error message

invalid provider matching pattern %q: namespace can be a wildcard only if the provider type is also a wildcard

What it means

A wildcard namespace is only legal when the provider type is also a wildcard. "registry/*/*" is allowed (matches every provider under every namespace on that host); "registry/*/aws" is rejected because wildcarding namespace while pinning type is not a supported selection shape.

Source

Thrown at internal/getproviders/multi_source.go:191

		if err != nil {
			return nil, fmt.Errorf("invalid provider type %q in provider matching pattern %q: must either be the wildcard * or a provider type name", parts[1], str)
		}
		namespace, err := normalizeProviderNamespaceOrWildcard(parts[0])
		if err != nil {
			return nil, fmt.Errorf("invalid registry namespace %q in provider matching pattern %q: must either be the wildcard * or a literal namespace", parts[1], str)
		}

		ret[i] = addrs.Provider{
			Hostname:  host,
			Namespace: namespace,
			Type:      pType,
		}

		if ret[i].Hostname == svchost.Hostname(Wildcard) && !(ret[i].Namespace == Wildcard && ret[i].Type == Wildcard) {
			return nil, fmt.Errorf("invalid provider matching pattern %q: hostname can be a wildcard only if both namespace and provider type are also wildcards", str)
		}
		if ret[i].Namespace == Wildcard && ret[i].Type != Wildcard {
			return nil, fmt.Errorf("invalid provider matching pattern %q: namespace can be a wildcard only if the provider type is also a wildcard", str)
		}
	}
	return ret, nil
}

// CanHandleProvider returns true if and only if the given provider address
// is both included by the selector's include patterns and _not_ excluded
// by its exclude patterns.
//
// The absense of any include patterns is treated the same as a pattern
// that matches all addresses. Exclusions take priority over inclusions.
func (s MultiSourceSelector) CanHandleProvider(addr addrs.Provider) bool {
	switch {
	case s.Exclude.MatchesProvider(addr):
		return false
	case len(s.Include) > 0:
		return s.Include.MatchesProvider(addr)
	default:

View on GitHub (pinned to c9def3e214)

Solutions

Wildcard the type as well: "registry.terraform.io/*/*".
List each concrete namespace explicitly: "hashicorp/aws", "myorg/aws", ...
Drop to a two-segment default-registry form if applicable.

Example fix

# before
include = ["registry.terraform.io/*/aws"]

# after
include = [
  "registry.terraform.io/hashicorp/aws",
  "registry.terraform.io/myorg/aws",
]
# or, to match everything on that host: ["registry.terraform.io/*/*"]

Defensive patterns

Strategy: validation

Validate before calling

// Enforce: namespace wildcard implies type wildcard.
if parts[len(parts)-2] == "*" && parts[len(parts)-1] != "*" {
    return fmt.Errorf("namespace wildcard requires type wildcard")
}

Prevention

Wildcard the type whenever you wildcard the namespace.
List concrete namespaces explicitly for per-type selection.
Use "host/*/*" to match all providers on a host.

When it happens

Trigger: Writing a pattern with "*" as the namespace but a concrete type, e.g. "registry.terraform.io/*/aws" or "hashicorp/*/aws". The validator enforces that namespace wildcard implies type wildcard.

Common situations: Trying to select "all namespaces for this provider name" in a mirror include rule; that granularity is not expressible in the pattern grammar.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/f62ef8f14074bfd2. Report an issue: GitHub.