hashicorp/terraform · error

missing profile in provider block %v

Error message

missing profile in provider block %v

What it means

Returned when auth="SecurityToken" and the config_file_profile attribute is empty. Security token authentication requires a named profile from the OCI config file to load the security token, key, and related settings. Without a profile name, the SDK cannot locate the credentials.

Source

Thrown at internal/backend/remote-state/oci/auth.go:246

		cfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)
		if err != nil {
			return nil, err
		}
		logger.Debug(" Configuration provided by: %s", cfg)

		configProviders = append(configProviders, cfg)

	case strings.ToLower(AuthSecurityToken):
		logger.Info("Attempting to authenticate using security token")
		if p.region == "" {
			return nil, fmt.Errorf("can not get %s from Terraform configuration (SecurityToken)", RegionAttrName)
		}
		// if region is part of the provider block make sure it is part of the final configuration too, and overwrites the region in the profile. +
		regionProvider := common.NewRawConfigurationProvider("", "", p.region, "", "", nil)
		configProviders = append(configProviders, regionProvider)

		if p.configFileProfile == "" {
			return nil, fmt.Errorf("missing profile in provider block %v", ConfigFileProfileAttrName)
		}

		defaultPath := path.Join(getHomeFolder(), DefaultConfigDirName, DefaultConfigFileName)
		if err := checkProfile(p.configFileProfile, defaultPath); err != nil {
			return nil, err
		}
		securityTokenBasedAuthConfigProvider, err := common.ConfigurationProviderForSessionTokenWithProfile(defaultPath, p.configFileProfile, p.privateKeyPassword)
		if err != nil {
			return nil, fmt.Errorf("could not create security token based auth config provider %v", err)
		}
		configProviders = append(configProviders, securityTokenBasedAuthConfigProvider)
	case strings.ToLower(ResourcePrincipal):
		logger.Info("Attempting to authenticate using resource principal credentials")
		var err error
		var resourcePrincipalAuthConfigProvider auth.ConfigurationProviderWithClaimAccess

		if p.region == "" {
			logger.Debug("did not get %s from Terraform configuration (ResourcePrincipal), falling back to environment variable", RegionAttrName)

View on GitHub (pinned to d32a084675)

Solutions

1. Add 'config_file_profile' to the backend block (e.g., config_file_profile = "DEFAULT").
2. Create or verify the profile exists in ~/.oci/config with the security token settings.
3. Use OCI_CLI_PROFILE environment variable as a fallback if the backend block must stay minimal.

Example fix

// before
backend "oci" {
  auth   = "SecurityToken"
  region = "us-phoenix-1"
}

// after
backend "oci" {
  auth               = "SecurityToken"
  region             = "us-phoenix-1"
  config_file_profile = "DEFAULT"
}

func validateOCIBackendConfig(cfg BackendConfig) error {
    if strings.EqualFold(cfg.Auth, "SecurityToken") {
        if cfg.ConfigFileProfile == "" {
            return fmt.Errorf("config_file_profile is required for SecurityToken auth")
        }
    }
    return nil
}

// Pre-init validation:
if err := validateOCIBackendConfig(backendCfg); err != nil {
    log.Fatal(err)
}

When it happens

Trigger: Backend block sets auth="SecurityToken" and region is set, but config_file_profile is missing or empty.

Common situations: User set up security token auth but forgot to specify which config file profile to use; user expects DEFAULT profile to be picked up automatically but this code path requires an explicit config_file_profile attribute.

Related errors

• can not get %s from Terraform configuration (SecurityToken)
• could not create security token based auth config provider %
• can not get private_key or private_key_path from Terraform c
• unable to determine region from Terraform backend configurat
• unable to determine region from Terraform backend configurat

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/1316fd23b9fb95ce. Report an issue: GitHub.