No more than one provider_installation block may be specifie

Error message

No more than one provider_installation block may be specified

What it means

Emitted by `Config.Validate` (cliconfig.go:321-324) when more than one `provider_installation` block exists across the merged CLI config. `Config.ProviderInstallation` is a slice precisely so this count can be validated; only one such block (containing multiple method blocks) is permitted.

Source

Thrown at internal/command/cliconfig/cliconfig.go:323

		_, err := svchost.ForComparison(givenHost)
		if err != nil {
			diags = diags.Append(
				fmt.Errorf("The credentials %q block has an invalid hostname: %s", givenHost, err),
			)
		}
	}

	// Should have zero or one "credentials_helper" blocks
	if len(c.CredentialsHelpers) > 1 {
		diags = diags.Append(
			fmt.Errorf("No more than one credentials_helper block may be specified"),
		)
	}

	// Should have zero or one "provider_installation" blocks
	if len(c.ProviderInstallation) > 1 {
		diags = diags.Append(
			fmt.Errorf("No more than one provider_installation block may be specified"),
		)
	}

	if c.PluginCacheDir != "" {
		_, err := os.Stat(c.PluginCacheDir)
		if err != nil {
			diags = diags.Append(
				fmt.Errorf("The specified plugin cache dir %s cannot be opened: %s", c.PluginCacheDir, err),
			)
		}
	}

	return diags
}

// Merge merges two configurations and returns a third entirely
// new configuration with the two merged.
func (c *Config) Merge(c2 *Config) *Config {

View on GitHub (pinned to c9def3e214)

Solutions

Consolidate into a single `provider_installation` block and put multiple `direct`, `filesystem_mirror`, `network_mirror`, or `dev_overrides` blocks inside it.
Audit every file Terraform loads for the CLI config and remove extras.
Re-run `terraform init` to confirm `Validate` passes.

Example fix

# before
provider_installation {
  filesystem_mirror { path = "/opt/mirror" }
}
provider_installation {
  dev_overrides { "hashicorp/aws" = "/src/aws" }
}
# No more than one provider_installation block may be specified

# after (merge method blocks into one)
provider_installation {
  filesystem_mirror { path = "/opt/mirror" }
  dev_overrides { "hashicorp/aws" = "/src/aws" }
}

Defensive patterns

Strategy: validation

Validate before calling

// Ensure only one provider_installation block exists across CLI config.
func countProviderInstallation(files []string) int {
    n := 0
    for _, f := range files {
        b, _ := os.ReadFile(f)
        if bytes.Contains(b, []byte("provider_installation")) {
            n++
        }
    }
    return n
}

Prevention

Put multiple installation methods inside a single `provider_installation` block.
Search every loaded file for the block before combining configs.
Avoid splitting dev_overrides into its own top-level block.

When it happens

Trigger: Two `provider_installation { ... }` blocks anywhere in the loaded CLI config (`.terraformrc` and/or any `*.tfrc`/`*.tfrc.json` in the config dir), which the Merge step appends into a single slice.

Common situations: Maintaining separate `provider_installation` blocks in different files that both get merged; copy-pasting a dev-overrides config alongside an existing filesystem-implied installation config.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/f4a17611c9256fcc. Report an issue: GitHub.