Terraform "No valid credential sources found" for the AWS provider in CI

By Kaveh Alemi·Latchkey

The AWS provider walks its credential chain (environment variables, shared profiles, web identity/OIDC, instance metadata) and found nothing usable. With no credentials, it cannot make any API call, so plan fails before reading state or resources.

What this error means

plan or apply fails with "Error: No valid credential sources found" and a note that the provider could not find AWS credentials.

Error: No valid credential sources found

Please see https://registry.terraform.io/providers/hashicorp/aws for more
information about providing credentials.

Error: failed to refresh cached credentials, no EC2 IMDS role found

Common causes

No credentials were exposed to the step

No AWS_ACCESS_KEY_ID/secret, no profile, and no OIDC role were configured, so the provider chain comes up empty.

OIDC role assumption was not configured

The workflow intended to use GitHub OIDC but the configure-aws-credentials step (or its permissions) was missing, so no web-identity credentials exist.

How to fix it

Assume a role via OIDC before Terraform

1. Grant the job id-token: write permission.
2. Run configure-aws-credentials with role-to-assume to mint short-lived creds.
3. Run Terraform after, so the provider finds the assumed role.

permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/ci-deploy
      aws-region: us-east-1

Provide static keys from secrets if not using OIDC

For accounts without OIDC, inject credentials from secrets into the provider's environment variables.

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

How to prevent it

• Prefer short-lived OIDC role assumption over long-lived keys.
• Run the credentials step before any Terraform command.
• Confirm the job has id-token: write when using OIDC.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation