Terraform provider registry 403 / network failure during init
After resolving versions, init downloads the provider binaries. A 403 (auth/rate limit) or a network drop on that download leaves init unable to install the selected provider.
What this error means
terraform init resolves a version, then fails downloading the provider with an HTTP 403, a TLS/connection error, or a checksum/network failure from the registry CDN.
terraform
Error: Failed to install provider
Error while installing hashicorp/aws v5.40.0: could not query provider
registry for registry.terraform.io/hashicorp/aws: returned an unexpected
status code 403 ForbiddenCommon causes
Registry rate limit or auth
A shared CI egress IP hits the public registry rate limit, or a private registry rejects the request for lack of a token.
Proxy strips or blocks the download
A corporate proxy returns 403 for the CDN host the registry redirects to.
Transient network failure
A dropped connection or DNS hiccup interrupts the binary download.
How to fix it
Use a provider mirror or cache
Serve providers from an internal mirror to avoid public rate limits and proxy issues.
Terminal
terraform providers mirror ./vendor/providers
# then point CLI config at the local mirror:
export TF_CLI_CONFIG_FILE=./mirror.tfrcAuthenticate and allow the CDN host
- For a private registry, set the host
TF_TOKEN_*token. - Allow egress to the registry and its release CDN through the proxy.
- Retry once for a transient 403/connection error.
How to prevent it
- Cache providers or run a filesystem mirror in CI.
- Pin versions and commit the lock file to reduce re-downloads.
- Use a dedicated egress IP or NAT to avoid shared rate limits.
Frequently asked questions
What causes "provider registry 403 / network"?
A shared CI egress IP hits the public registry rate limit, or a private registry rejects the request for lack of a token.
How do I fix provider registry 403 / network?
Serve providers from an internal mirror to avoid public rate limits and proxy issues.
Related guides
Terraform "Failed to query available provider packages" in CIFix Terraform init "Failed to query available provider packages" in CI - a bad source address, a network bloc…
Terraform "Could not retrieve the list of available versions for provider"Fix Terraform init "Could not retrieve the list of available versions for provider" in CI - a version constra…
Terraform "Required token could not be found" - backend auth in CIFix Terraform "required token could not be found" during init in CI - the remote backend or private registry…