HCP Terraform agent "no valid credential sources" for provider in CI

By Daniel Zoghalchali·Latchkey

When execution mode is remote (or an agent), the plan/apply runs on HCP Terraform infrastructure, not on your CI runner. Provider credentials set only as CI env vars never reach the remote run, so the AWS/GCP/Azure provider reports no valid credential sources.

What this error means

A remote HCP Terraform run fails during plan/apply with "Error: No valid credential sources found" (or the provider equivalent), even though the same credentials work in a local run on the CI runner.

Error: No valid credential sources found

Please see https://registry.terraform.io/providers/hashicorp/aws
for more information about providing credentials.

Common causes

Credentials set on the CI runner, not the workspace

Remote execution ignores the runner env. AWS/GCP/Azure variables must be configured as workspace environment variables in HCP Terraform to reach the remote run.

Missing dynamic provider credentials configuration

If you intended OIDC-based dynamic credentials, the workspace variables that enable them are absent, so the provider finds nothing.

How to fix it

Set provider credentials as workspace variables

1. Open the workspace in HCP Terraform.
2. Add the provider credentials as environment variables (mark secrets as sensitive).
3. Re-run so the remote agent sees them.

# workspace environment variables (set in HCP Terraform, not CI):
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...   # sensitive

Or run in local execution mode

Set the workspace execution mode to local so the plan/apply runs on your CI runner, where the credentials already exist.

How to prevent it

• Decide execution mode per workspace and put provider credentials where that mode runs.
• Prefer dynamic provider credentials (OIDC) for remote workspaces over static keys.
• Do not assume CI runner env vars reach remote HCP Terraform runs.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation