Terraform Google Provider Credential Errors in CI
The google provider could not find Application Default Credentials. No service account key, no workload-identity token, and no gcloud auth are available to the runner.
What this error means
plan/apply fails with "could not find default credentials" from the google provider, or an error that the project is not set. It happens on a fresh runner without GCP auth configured.
Error: Attempted to load application default credentials since neither
`credentials` nor `access_token` was set in the provider block. No credentials
loaded. To use your gcloud credentials, run 'gcloud auth application-default login'Common causes
No Application Default Credentials
The runner has no GOOGLE_CREDENTIALS/GOOGLE_APPLICATION_CREDENTIALS, no workload-identity token, and no gcloud login, so ADC resolves to nothing.
Project not configured
Even with credentials, a missing project in the provider or GOOGLE_PROJECT env can fail operations that need an explicit project.
How to fix it
Authenticate via workload identity federation
Use keyless federation from GitHub OIDC to obtain short-lived GCP credentials.
- uses: google-github-actions/auth@v2
with:
workload_identity_provider: projects/123/locations/global/workloadIdentityPools/ci/providers/gh
service_account: ci-terraform@my-project.iam.gserviceaccount.comOr provide a service account key
Set GOOGLE_CREDENTIALS from a secret and configure the project.
env:
GOOGLE_CREDENTIALS: ${{ secrets.GCP_SA_KEY }}
GOOGLE_PROJECT: my-projectHow to prevent it
- Use workload identity federation instead of static SA keys.
- Set
project/GOOGLE_PROJECTso operations have an explicit project. - Keep any SA key as a secret and rotate it.