Error map
Error loading state: AccessDenied (S3 backend) Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403
Terraform · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (11). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (11)
Terraform: Error: Error acquiring the state lock — ConditionalCheckFailedException / state blob is already locked
Another Terraform run holds the state lock, or a previous run crashed and left the lock behind.
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
Terraform: Error: Failed to get existing workspaces: S3 bucket "my-tf-state" does not exist / NoSuchBucket: The specified bucket does not exist
The S3 bucket configured as the state backend doesn't exist (or is in another region/account).
Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity
The `region` is invalid/unavailable, or the provider can't reach AWS endpoints to validate credentials.
Terraform: Error: Backend initialization required, please run "terraform init" — Reason: Initial configuration of the requested backend "s3"
Terraform needs `terraform init` to set up the backend (new directory, changed backend config, missing `.terraform`).
Terraform: Error: Error acquiring the state lock: ResourceNotFoundException: Requested resource not found / failed to retrieve lock info
The S3 backend's `dynamodb_table` doesn't exist, so locking fails.
Terraform: Error: Backend configuration changed — A change in the backend configuration has been detected, which may require migrating existing state
The saved backend settings in `.terraform` differ from the current configuration.
Terraform: Error: Output refers to sensitive values — a root module output containing sensitive data must be explicitly marked as sensitive
An output (or module output) exposes a value derived from a sensitive variable/attribute without `sensitive = true`.
Terraform: Error: No valid credential sources found — failed to refresh cached credentials, no EC2 IMDS role found / Error: configuring Terraform AWS Provider: no valid credential sources
The AWS provider found no credentials (env vars, shared config, SSO, role, instance profile).
Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances
The IAM identity used by Terraform lacks a permission needed for that resource.
Terraform: Error: deleting S3 Bucket (my-bucket): BucketNotEmpty: The bucket you tried to delete is not empty
Terraform can't delete an S3 bucket that still holds objects (or versions).
Two steps away (27)
Deadlock found when trying to get lock; try restarting transaction
Two transactions waited on each other’s locks; the database killed one so the other could continue.
HTTP 409 Conflict
The request conflicts with the current state of the resource — e.g. a duplicate or an edit based on an outdated version.
Error: Too many re-renders. React limits the number of renders to prevent an infinite loop.
A state update runs during render, which triggers another render, which updates state again — forever.
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
Terraform: Error: Failed to select workspace: workspace "staging" doesn't exist / Currently selected workspace "x" does not exist
The workspace you selected (or that `.terraform/environment` points to) isn't present in the backend.
S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint
The request went to the wrong S3 region/endpoint for that bucket.
InvalidKeyPair.NotFound: The key pair 'x' does not exist
The key pair name you passed doesn’t exist in that region (key pairs are regional).
InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist
The AMI ID isn’t available in this region/account — AMI IDs are regional and private AMIs must be shared.
Terraform: Error: Failed to query available provider packages — Could not retrieve the list of available versions for provider hashicorp/aws: no available releases match the given constraints
`terraform init` can't find a provider version matching your constraints (or can't reach the registry).
Terraform: Error: Failed to install provider — Error while installing hashicorp/aws v5.40.0: could not query provider registry / Get "https://releases.hashicorp.com/...": dial tcp: i/o timeout
Terraform found the provider version but couldn't download/verify the package.
Terraform: Error: state snapshot was created by Terraform v1.9.0, which is newer than current v1.6.6; upgrade to Terraform v1.9.0 or greater to work with this state
The remote/local state was last written by a newer Terraform CLI than the one you're running.
Terraform: Error: Cannot import non-existent remote object — While attempting to import an existing object to "aws_s3_bucket.logs", the provider detected that no object exists with the given id
`terraform import` (or an import block) used an ID that the provider can't find.
Terraform: # aws_instance.web is tainted, so must be replaced — -/+ destroy and then create replacement
A previous apply failed during creation, so Terraform marked the resource tainted and will recreate it.
Terraform: Error: Kubernetes cluster unreachable: Get "http://localhost/version": dial tcp 127.0.0.1:80: connect: connection refused
The Kubernetes/Helm provider can't connect to the cluster (no config, cluster not ready at plan time, expired credentials).
GitHub Actions: Error: Unable to process file command 'output' successfully. Invalid format 'x'
A line written to `$GITHUB_OUTPUT`, `$GITHUB_ENV` or `$GITHUB_STATE` is not in `name=value` form — usually a multi-line value wit…
Terraform: Error: Invalid for_each argument — The "for_each" map includes keys derived from resource attributes that cannot be determined until apply
`for_each` keys depend on values only known after apply, so Terraform can't plan which instances exist.
Terraform: Error: Invalid value for variable — "instance_type" must be a t3 type / The given value is not suitable for var.x declared at variables.tf:1,1-17: string required
A variable value failed its type or `validation` block.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server
The Cloud Run service requires authentication and the caller has no valid identity token or the `roles/run.invoker` role.
Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist)
The caller's identity lacks the IAM permission named in the message on that resource.
Terraform: Error: deleting EC2 VPC (vpc-0abc): DependencyViolation: The vpc 'vpc-0abc' has dependencies and cannot be deleted
Destroy failed because something else still uses the resource (ENIs, subnets, gateways, security group rules).
Terraform: Error: Instance cannot be destroyed — Resource aws_db_instance.prod has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed
The plan would destroy a resource protected with `lifecycle { prevent_destroy = true }`.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError