Error map
Output refers to sensitive values Terraform: Error: Output refers to sensitive values — a root module output containing sensitive data must be explicitly marked as sensitive
Terraform · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (8). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (8)
GitHub Actions: Error: Unable to process file command 'output' successfully. Invalid format 'x'
A line written to `$GITHUB_OUTPUT`, `$GITHUB_ENV` or `$GITHUB_STATE` is not in `name=value` form — usually a multi-line value wit…
Terraform: Error: building AzureRM Client: obtaining subscription ID / Please run 'az login' to setup account
The AzureRM provider can't find Azure credentials or a subscription.
Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity
The `region` is invalid/unavailable, or the provider can't reach AWS endpoints to validate credentials.
Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403
Terraform can't read/write the S3 bucket (or DynamoDB table) that stores state — IAM permissions or wrong credentials/role.
Terraform: Error: Invalid for_each argument — The "for_each" map includes keys derived from resource attributes that cannot be determined until apply
`for_each` keys depend on values only known after apply, so Terraform can't plan which instances exist.
Terraform: Error: Invalid value for variable — "instance_type" must be a t3 type / The given value is not suitable for var.x declared at variables.tf:1,1-17: string required
A variable value failed its type or `validation` block.
Terraform: Error: No valid credential sources found — failed to refresh cached credentials, no EC2 IMDS role found / Error: configuring Terraform AWS Provider: no valid credential sources
The AWS provider found no credentials (env vars, shared config, SSO, role, instance profile).
Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances
The IAM identity used by Terraform lacks a permission needed for that resource.
Two steps away (24)
GitHub Actions: Invalid workflow file: .github/workflows/ci.yml#L12 — You have an error in your yaml syntax on line 12
GitHub could not parse your workflow YAML, so no run was created — usually indentation, a tab, or an unquoted special character.
GitHub Actions: The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files
Workflows (or old actions) still use `::set-output`, which must be replaced by writing to the `$GITHUB_OUTPUT` file.
GitHub Actions: Error: Unable to process command '::set-env name=X::y' successfully. The `set-env` command is disabled
A script or old action uses `::set-env` / `::add-path`, which GitHub disabled; write to `$GITHUB_ENV` and `$GITHUB_PATH` instead.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…
S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint
The request went to the wrong S3 region/endpoint for that bucket.
InvalidKeyPair.NotFound: The key pair 'x' does not exist
The key pair name you passed doesn’t exist in that region (key pairs are regional).
InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist
The AMI ID isn’t available in this region/account — AMI IDs are regional and private AMIs must be shared.
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
Terraform: Error: Error acquiring the state lock — ConditionalCheckFailedException / state blob is already locked
Another Terraform run holds the state lock, or a previous run crashed and left the lock behind.
Terraform: Error: Backend initialization required, please run "terraform init" — Reason: Initial configuration of the requested backend "s3"
Terraform needs `terraform init` to set up the backend (new directory, changed backend config, missing `.terraform`).
Terraform: Error: Reference to undeclared resource / Reference to undeclared input variable
The configuration refers to a resource, data source, variable or module output that isn’t declared in this module.
Terraform: Error: Invalid count argument — The "count" value depends on resource attributes that cannot be determined until apply
`count` depends on something unknown at plan time, so Terraform can't decide how many instances to create.
Terraform: Error: Cycle: aws_security_group.a, aws_security_group.b
Resources reference each other (directly or indirectly), so Terraform can't order them.
DynamoDB ValidationException: One or more parameter values were invalid: Missing the key pk in the item / The provided key element does not match the schema
The item or key doesn’t match the table’s primary key schema — wrong attribute name, wrong type, or missing sort key.
strict decoding error: unknown field "spec.template.spec.containers[0].ports[0].protocl"
The manifest contains a field the API schema doesn’t know — a typo, wrong indentation, or a field from another API version.
error converting YAML to JSON: yaml: line 12: did not find expected key
The manifest isn’t valid YAML — usually indentation, a tab character, or an unquoted special character.
UnrecognizedClientException: The security token included in the request is invalid
The access key or session token isn’t recognised — wrong/deleted key, a session token missing for temporary credentials, or a reg…
GitHub Actions: Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers
`aws-actions/configure-aws-credentials` found no usable credentials — no keys, no role to assume, or the OIDC token was not reque…
Jenkins: ERROR: Could not find credentials entry with ID 'github-token'
The Jenkinsfile references a credentials ID that does not exist in the scope Jenkins can see for this job.
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server
The Cloud Run service requires authentication and the caller has no valid identity token or the `roles/run.invoker` role.
Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist)
The caller's identity lacks the IAM permission named in the message on that resource.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError