provider %s: required by this configuration but no version i

Error message

provider %s: required by this configuration but no version is selected

What it means

Raised when a provider is referenced by the configuration but has no entry in the dependency lock file (.terraform.lock.hcl). VerifyDependencySelections iterates ProviderRequirements and, for each lockable provider, looks up depLocks.Provider(addr); a nil result (line 291) means init never recorded a selected version. This is the canonical 'you forgot to terraform init' / 'lock file is incomplete' signal.

Source

Thrown at internal/configs/config.go:293

		if !depsfile.ProviderIsLockable(providerAddr) {
			continue // disregard builtin providers, and such
		}
		if depLocks != nil && depLocks.ProviderIsOverridden(providerAddr) {
			// The "overridden" case is for unusual special situations like
			// dev overrides, so we'll explicitly note it in the logs just in
			// case we see bug reports with these active and it helps us
			// understand why we ended up using the "wrong" plugin.
			log.Printf("[DEBUG] Config.VerifyDependencySelections: skipping %s because it's overridden by a special configuration setting", providerAddr)
			continue
		}

		var lock *depsfile.ProviderLock
		if depLocks != nil { // Should always be true in main code, but unfortunately sometimes not true in old tests that don't fill out arguments completely
			lock = depLocks.Provider(providerAddr)
		}
		if lock == nil {
			log.Printf("[TRACE] Config.VerifyDependencySelections: provider %s has no lock file entry to satisfy %q", providerAddr, providerreqs.VersionConstraintsString(constraints))
			errs = append(errs, fmt.Errorf("provider %s: required by this configuration but no version is selected", providerAddr))
			continue
		}

		selectedVersion := lock.Version()
		allowedVersions := providerreqs.MeetingConstraints(constraints)
		log.Printf("[TRACE] Config.VerifyDependencySelections: provider %s has %s to satisfy %q", providerAddr, selectedVersion.String(), providerreqs.VersionConstraintsString(constraints))
		if !allowedVersions.Has(selectedVersion) {
			// The most likely cause of this is that the author of a module
			// has changed its constraints, but this could also happen in
			// some other unusual situations, such as the user directly
			// editing the lock file to record something invalid. We'll
			// distinguish those cases here in order to avoid the more
			// specific error message potentially being a red herring in
			// the edge-cases.
			currentConstraints := providerreqs.VersionConstraintsString(constraints)
			lockedConstraints := providerreqs.VersionConstraintsString(lock.VersionConstraints())
			switch {
			case currentConstraints != lockedConstraints:

View on GitHub (pinned to c9def3e214)

Solutions

Run `terraform init` to install the provider and write its lock entry.
If using a custom registry or local filesystem mirror, confirm the provider is reachable: `terraform providers lock -platform=linux_amd64`.
Verify .terraform.lock.hcl is committed and not gitignored; if deleted, restore it and re-run init.
Check for typos in the provider source address in required_providers.

Example fix

// before: plan fails with "provider hashicorp/aws: required ... no version is selected"

// after
$ terraform init

Defensive patterns

Strategy: validation

Validate before calling

// Gate plan/apply behind a successful `terraform init` step, then assert the lock
// file lists every provider returned by `terraform providers`.
// In Go: read .terraform.lock.hcl and confirm each required provider address has an entry.

Prevention

Always commit .terraform.lock.hcl (do not gitignore it).
Run terraform init as the first step of every CI job.
Add new providers via `terraform init` so the lock entry is written automatically.

When it happens

Trigger: Adding a resource from a provider not yet installed, deleting .terraform.lock.hcl or .terraform/, switching to a module that introduces a new provider, or running plan/apply on a fresh clone without init. Providers marked overridden (dev overrides) are skipped, so this only fires for genuinely un-locked providers.

Common situations: Fresh CI checkout missing the .terraform directory, a teammate added an aws resource but didn't commit the lock update, a custom/local provider address that init skipped, or .terraform.lock.hcl gitignored.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/fe89650ff7c8a873. Report an issue: GitHub.