What causes "no resource identity schema found for %s (in provider %s)" in hashicorp/terraform?

Upgrade the provider to a version that defines resource identity schemas for that type and run `terraform init`.

no resource identity schema found for %s (in provider %s)

Error message

no resource identity schema found for %s (in provider %s)

What it means

Thrown when a resource instance stores identity JSON in state but the loaded provider's schema has no identity schema (schema.Identity == nil) for that resource type. The provider is loaded and defines the resource, but it does not define an identity schema, so the stored identity blob cannot be decoded or validated.

Source

Thrown at internal/command/jsonstate/state.go:437

			if ri.Current != nil {
				if schema.Version != int64(ri.Current.SchemaVersion) {
					return nil, fmt.Errorf("schema version %d for %s in state does not match version %d from the provider", ri.Current.SchemaVersion, resAddr, schema.Version)
				}

				current.SchemaVersion = ri.Current.SchemaVersion

				if schema.Body == nil {
					return nil, fmt.Errorf("no schema found for %s (in provider %s)", resAddr.String(), r.ProviderConfig.Provider)
				}

				// Check if we have an identity in the state
				if ri.Current.IdentityJSON != nil {
					if schema.IdentityVersion != int64(ri.Current.IdentitySchemaVersion) {
						return nil, fmt.Errorf("resource identity schema version %d for %s in state does not match version %d from the provider", ri.Current.IdentitySchemaVersion, resAddr, schema.IdentityVersion)
					}

					if schema.Identity == nil {
						return nil, fmt.Errorf("no resource identity schema found for %s (in provider %s)", resAddr.String(), r.ProviderConfig.Provider)
					}

					current.IdentitySchemaVersion = &ri.Current.IdentitySchemaVersion
				}

				riObj, err := ri.Current.Decode(schema)
				if err != nil {
					return nil, err
				}

				var value cty.Value
				var sensitivePaths []cty.Path
				value, current.AttributeValues, sensitivePaths, err = marshalAttributeValues(riObj.Value)
				if err != nil {
					return nil, fmt.Errorf("preparing attribute values for %s: %w", current.Address, err)
				}
				sensitivePaths = append(sensitivePaths, schema.Body.SensitivePaths(value, nil)...)
				s := SensitiveAsBool(marks.MarkPaths(value, marks.Sensitive, sensitivePaths))

View on GitHub (pinned to c9def3e214)

Solutions

Upgrade the provider to a version that defines resource identity schemas for that type and run `terraform init`.
Confirm via `terraform providers schema -json` that the provider's resource type has an `identity` block.
If identity support was deliberately removed, re-apply with the original provider version to clear the stored identity, then switch.
As a last resort, `terraform state rm` and re-import the resource to drop the legacy identity data.

Defensive patterns

Strategy: validation

Validate before calling

// Before serializing state as JSON, ensure the provider defines an identity schema where state has identity data.
for _, r := range state.Resources {
    if r.Current == nil || r.Current.IdentityJSON == nil { continue }
    s := schemas.ResourceTypeConfig(r.ProviderConfig.Provider, r.Addr.Mode, r.Addr.Type)
    if s.Identity == nil {
        return fmt.Errorf("state has identity for %s but provider %s defines no identity schema", r.Addr, r.ProviderConfig.Provider)
    }
}

Try / catch

if _, err := jsonstate.MarshalState(state, schemas); err != nil {
    // No identity schema in provider: upgrade the provider or clear legacy identity data.
    return err
}

Prevention

Do not downgrade providers below the version that wrote identity data.
Verify identity schema presence via `terraform providers schema -json` after init.
When removing identity support intentionally, re-apply first to clear stored identity.

When it happens

Trigger: Occurs in jsonstate when ri.Current.IdentityJSON != nil and schema.Identity == nil. Triggered when state contains identity data (written by a provider version that supported resource identity) but the currently-loaded provider version does not define an identity schema for the type.

Common situations: Downgrading a provider from a version with identity support to one without, or using a community/fork provider that omits identity schemas. Also possible if the state was written by a newer Terraform/provider combo and the environment was rolled back.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/2e2bbae41883e16e. Report an issue: GitHub.