Provider download blocked due to policy violations. Please r

Error message

Provider download blocked due to policy violations. Please review other diagnostics for details.

What it means

Raised during init when an HCP Terraform / Terraform Enterprise policy evaluation (provider policy) returns error-level diagnostics, blocking the provider download. The policy (e.g. a Sentinel policy set or a custom policy) denied the provider. Details are emitted as separate diagnostics before this summary error.

Source

Thrown at internal/command/meta_policy.go:175

			Version:   version,
		},
	})
	// We use the root module as the module for provider configs since the version resolution
	// is ambiguous, and we do not know which module the provider config belongs to.
	addr := addrs.AbsProviderConfig{Provider: provider, Module: addrs.RootModule}
	providerConfig := p.rootModule.ProviderConfigs[provider.Type]

	if providerConfig != nil {
		// Annotate the result diagnostics with the local range so that diagnostics can be rendered with both the
		// policy source and the object being enforced.
		result = result.WithLocalRange(providerConfig.DeclRange.Ptr())
	}
	p.view.PolicyResult(addr.String(), result)
	log.Println("[DEBUG] init: policy result for provider", provider.String(), version, "overall", result.Overall)
	// Init uses diagnostics as the blocking signal because advisory policies
	// may return deny without any error diagnostics.
	if result.Diagnostics.HasErrors() {
		return fmt.Errorf("Provider download blocked due to policy violations. Please review other diagnostics for details.")
	}

	return nil
}

View on GitHub (pinned to c9def3e214)

Solutions

Review the other diagnostics emitted before this error — they name the policy and the provider that failed.
Update the policy set (in HCP Terraform / TFE) to allow the required provider/version, or use an approved alternative.
Remove the disallowed provider from your configuration.
Verify the provider source address and version match what the policy expects.

Example fix

// before
// terraform init -> Provider download blocked due to policy violations

// after
// In HCP Terraform/TFE policy set: allow registry.terraform.io/hashicorp/aws
// then re-run:
terraform init

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check your config's providers against the org allow-list before init
for _, p := range requiredProviders {
    if !allowList.Contains(p.Source) {
        return fmt.Errorf("provider %s not allowed by policy", p.Source)
    }
}

Prevention

Review the other diagnostics — they name the failing policy and provider.
Keep provider sources/versions within the org policy allow-list.
Coordinate policy set changes before adopting new providers.
Remove disallowed providers from configuration before running init.

When it happens

Trigger: meta_policy.go: result.Diagnostics.HasErrors() is true after PolicyEvaluateProviderRequest for a provider during init. Triggered when the configured policy set rejects a provider (e.g. disallows registry/hashicorp providers not on an allow-list, or version constraints fail policy).

Common situations: Organization mandates a provider allow-list and a requested provider is not permitted; a Sentinel policy requires specific provider versions; new/unapproved provider added to config; policy set updated to block a previously-allowed provider.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/1367a8800b3e5fff. Report an issue: GitHub.