What causes "unsupported ephemeral resource type %q" in hashicorp/terraform?

Use a provider that actually declares ephemeral resources (e.g. a secrets provider) instead of `terraform`.

unsupported ephemeral resource type %q

Error message

unsupported ephemeral resource type %q

What it means

Returned unconditionally by `ValidateEphemeralResourceConfig` (provider.go:226). The built-in `terraform` provider declares an empty `EphemeralResourceTypes` map in `GetProviderSchema`, so no ephemeral resource type is valid and validation always fails.

Source

Thrown at internal/builtin/providers/terraform/provider.go:226

	case "terraform_data":
		return moveDataStoreResourceState(req)
	default:
		var resp providers.MoveResourceStateResponse

		resp.Diagnostics = resp.Diagnostics.Append(fmt.Errorf("Error: unsupported resource %s", req.TargetTypeName))

		return resp
	}
}

// ValidateResourceConfig is used to to validate the resource configuration values.
func (p *Provider) ValidateResourceConfig(req providers.ValidateResourceConfigRequest) providers.ValidateResourceConfigResponse {
	return validateDataStoreResourceConfig(req)
}

func (p *Provider) ValidateEphemeralResourceConfig(req providers.ValidateEphemeralResourceConfigRequest) providers.ValidateEphemeralResourceConfigResponse {
	var resp providers.ValidateEphemeralResourceConfigResponse
	resp.Diagnostics = resp.Diagnostics.Append(fmt.Errorf("unsupported ephemeral resource type %q", req.TypeName))
	return resp
}

// OpenEphemeralResource implements providers.Interface.
func (p *Provider) OpenEphemeralResource(req providers.OpenEphemeralResourceRequest) providers.OpenEphemeralResourceResponse {
	var resp providers.OpenEphemeralResourceResponse
	resp.Diagnostics = resp.Diagnostics.Append(fmt.Errorf("unsupported ephemeral resource type %q", req.TypeName))
	return resp
}

// RenewEphemeralResource implements providers.Interface.
func (p *Provider) RenewEphemeralResource(req providers.RenewEphemeralResourceRequest) providers.RenewEphemeralResourceResponse {
	var resp providers.RenewEphemeralResourceResponse
	resp.Diagnostics = resp.Diagnostics.Append(fmt.Errorf("unsupported ephemeral resource type %q", req.TypeName))
	return resp
}

// CloseEphemeralResource implements providers.Interface.

View on GitHub (pinned to c9def3e214)

Solutions

Use a provider that actually declares ephemeral resources (e.g. a secrets provider) instead of `terraform`.
Confirm `len(GetProviderSchema().EphemeralResourceTypes) == 0` and skip dispatch.
Remove the `ephemeral` block targeting the built-in provider.

Example fix

// before
ephemeral "terraform_token" "x" { ... }

// after
ephemeral "vault_token" "x" { provider = vault ... }

Defensive patterns

Strategy: validation

Validate before calling

schema := provider.GetProviderSchema()
if _, ok := schema.EphemeralResourceTypes[req.TypeName]; !ok {
    return unsupportedEphemeral(req.TypeName) // do not call ValidateEphemeralResourceConfig
}

Type guard

func providerSupportsEphemeral(schema providers.GetProviderSchemaResponse, name string) bool {
    _, ok := schema.EphemeralResourceTypes[name]
    return ok
}

Prevention

The built-in terraform provider declares zero ephemeral resources; never route ephemeral blocks to it.
Use a dedicated secrets/ephemeral-capable provider for ephemeral resources.
Gating logic should treat an empty EphemeralResourceTypes map as 'unsupported'.

When it happens

Trigger: A `ValidateEphemeralResourceConfigRequest` is routed to this provider during validation of an `ephemeral` block, e.g. `ephemeral "terraform_token" "x" { ... }`, or by a test/runtime calling the method directly.

Common situations: A user writes an `ephemeral` block against the built-in `terraform` provider, which provides no ephemeral resources; an experimental runtime dispatches ephemeral validation here; a future Terraform feature misroutes.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/eb9a21faa0131463. Report an issue: GitHub.