NoCredentialProviders
This error occurs when the Go SDK or Terraform AWS provider fails to retrieve credentials from any configured credential providers in the chain.
Usually happens because:
- ☑ CI/CD runners run Go/Terraform jobs without exporting active credentials
- ☑ Docker containers execute binaries without credentials directories mounts
- ☑ Mismatched profile parameters defined inside Terraform provider blocks
🔍 Quick Checklist:
What is NoCredentialProviders?
A 'NoCredentialProviders' error (often formatted as 'NoCredentialProviders: no valid providers in chain. Deprecated.') is raised by the AWS SDK for Go or HashiCorp Terraform when they initialize a session but fail to locate valid credentials. Because Go SDK and Terraform execute in isolated runtime environments (like CI/CD pipelines, Docker containers, or serverless functions), they search environment variables, config files, and IAM metadata endpoints. If the search reaches the end of the chain empty, it triggers this error.
Common Causes
- Missing environment variables in CI/CD runners: Pipeline jobs (like GitHub Actions, GitLab CI) run Terraform without exporting the required AWS credentials.
- Docker container filesystem isolation: The containerized application runs without mounting the host's '~/.aws/' configuration directories.
- Terraform provider block mismatch: The Terraform code specifies a profile name or role ARN that does not match the active shell configuration.
| Cause | Frequency |
|---|---|
| Missing AWS environment variables in CI/CD pipeline runners | ⭐⭐⭐⭐⭐ |
| Terraform provider profile name typo or mismatch | ⭐⭐⭐⭐ |
| Docker container filesystem isolation (missing ~/.aws mount) | ⭐⭐⭐ |
Common Mistakes
- Hardcoding static secrets inside configuration repositories, causing security auditing software to quarantine files.
- Forgetting to mount host profiles when calling Go containerized executables.
How to Fix
AWS Operations & Verification
Configure the AWS Provider block to dynamically assume an IAM execution role using active session contexts.
provider "aws" {
region = "us-west-2"
# Configure assume role to bypass local credentials keys issues
assume_role {
role_arn = "arn:aws:iam::123456789012:role/terraform-execution-role"
session_name = "TerraformSession"
}
}Platform Specific Fixes
Mount local host credentials folder inside Docker container run command contexts.
# Mount host configurations read-only into root directory of container
docker run -it -v ~/.aws:/root/.aws:ro golang-app-runnerBest Practices
- Always prefer OIDC role assumption configurations in CI/CD runner pipelines.
- Verify credentials loading behavior locally prior to deployment tasks.
Frequently Asked Questions (FAQ)
Q: What is the NoCredentialProviders error?
This is the Go SDK and Terraform equivalent of 'Unable to locate credentials'. It means the AWS client chain looked through environment variables, credentials files, and metadata endpoints but found no valid credentials.
Q: How do I solve this error in Terraform?
You can either export standard environment variables ('AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY') in your terminal before running 'terraform plan', or define them inside the Terraform provider block. Using environment variables is highly recommended to avoid hardcoding keys in your code.
Q: How do I fix this error in GitHub Actions?
Use the official 'aws-actions/configure-aws-credentials' action to authenticate. This action uses OpenID Connect (OIDC) to assume an IAM role dynamically, injecting temporary session keys into the runner environment so Terraform can find them.
Q: Why does it say 'Deprecated' in the error message?
Legacy Go SDK v1 returns 'NoCredentialProviders: no valid providers in chain. Deprecated.' when it fails. The Go SDK v2 returns more specific errors detailing which provider failed, but the root cause remains the same: a completely empty credential chain.