hashicorp/terraform · error

resp.Status

Error message

resp.Status

What it means

Emitted from registryClient.ProviderVersions(), the GET /v1/providers/{ns}/{type}/versions call. It is the default branch of the status switch: any response code other than 200/404/401/403 (for example 5xx or 429) is wrapped as errQueryFailed(errors.New(resp.Status)).

Source

Thrown at internal/getproviders/registry_client.go:130

	c.addHeadersToRequest(req.Request)

	resp, err := c.httpClient.Do(req)
	if err != nil {
		return nil, nil, c.errQueryFailed(addr, err)
	}
	defer resp.Body.Close()

	switch resp.StatusCode {
	case http.StatusOK:
		// Great!
	case http.StatusNotFound:
		return nil, nil, ErrRegistryProviderNotKnown{
			Provider: addr,
		}
	case http.StatusUnauthorized, http.StatusForbidden:
		return nil, nil, c.errUnauthorized(addr.Hostname)
	default:
		return nil, nil, c.errQueryFailed(addr, errors.New(resp.Status))
	}

	// We ignore the platforms portion of the response body, because the
	// installer verifies the platform compatibility after pulling a provider
	// versions' metadata.
	type ResponseBody struct {
		Versions []struct {
			Version   string   `json:"version"`
			Protocols []string `json:"protocols"`
		} `json:"versions"`
		Warnings []string `json:"warnings"`
	}
	var body ResponseBody

	dec := json.NewDecoder(resp.Body)
	if err := dec.Decode(&body); err != nil {
		return nil, nil, c.errQueryFailed(addr, err)
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Retry the init; 5xx/429 are typically transient.
2. Pin exact provider versions in .terraform.lock.hcl / required_providers to reduce version-list lookups.
3. Use a filesystem or network mirror via provider_installation config.
4. Check registry status and proxy egress; add retryablehttp backoff if a custom client is in play.

Example fix

# pin versions to minimize registry round-trips and use a mirror
# ~/.terraformrc
provider_installation {
  filesystem_mirror { path = "~/.terraform.d/plugin-cache" }
}
# versions.tf
terraform { required_providers { aws = { source = "hashicorp/aws", version = "5.40.0" } } }

# retry init in CI to absorb transient 5xx/429 from the versions endpoint
#   n=0; until terraform init -input=false || [ $n -ge 4 ]; do n=$((n+1)); sleep $((n*20)); done

When it happens

Trigger: `terraform init` resolving available provider versions when the registry returns a server error, gateway timeout, or rate-limit response to the version-listing endpoint.

Common situations: Registry outage during init; aggressive CI parallelism triggering 429; private/Terraform Enterprise registry returning an unexpected code; flaky corporate proxy.

Related errors

• resp.Status
• HTTP remote state already locked, failed to read body
• Failed to read remote state: %s
• HTTP error: %d
• Failed to refresh module manifest: %w

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/16229f4114483908. Report an issue: GitHub.