🚨 OpenTofu Error: 'Invalid provider configuration' — Cause, Fix, and Troubleshooting Guide

Overview

Before OpenTofu can create resources it must configure the provider — credentials, region, endpoints. If a required setting is missing or invalid, the provider reports it back and OpenTofu surfaces it as an invalid provider configuration during plan/apply:

Error: Invalid provider configuration

Provider "registry.opentofu.org/hashicorp/aws" requires explicit configuration.
Add a provider block to the root module, or add a "provider" argument to the
module block that references this configuration.

Error: configuring Terraform AWS Provider: no valid credential sources for
Terraform AWS Provider found.

Symptoms

• tofu plan/apply fails with Invalid provider configuration or a provider-specific credential/region error.
• The message asks for an explicit provider block or names a missing/invalid setting.
• Works locally (where env vars/profiles exist) but fails in CI without credentials.
• Appears when a module needs a passed-in provider (provider / configuration_aliases) that was never wired.

Common Root Causes

• Missing credentials — no AWS_PROFILE/AWS_ACCESS_KEY_ID, no GCP ADC, no Azure login.
• Missing or wrong region/endpoint value in the provider block.
• Alias not passed to a module that declares configuration_aliases.
• Interpolated provider settings referencing an unset variable.
• Expired or wrong-account credentials for the target backend/provider.

How to diagnose

Read the provider error detail, then verify credentials for that provider:

tofu plan 2>&1 | sed -n '1,20p'
aws sts get-caller-identity        # AWS
gcloud auth application-default print-access-token >/dev/null && echo ok  # GCP

Inspect the provider block and any aliases:

grep -nA6 'provider "' *.tf
grep -rn 'configuration_aliases' modules/

Confirm required env vars are present in the runtime (not just your shell):

env | grep -E 'AWS_|GOOGLE_|ARM_' | sed 's/=.*/=***/'

Fixes

Provide credentials through the provider’s standard mechanism (env var or profile):

export AWS_PROFILE=prod
export AWS_REGION=us-east-1
tofu plan

Set required provider arguments explicitly:

provider "aws" {
  region = var.aws_region
}

Wire an aliased provider into a module that declares it:

# module requires: configuration_aliases = [aws.replica]
module "backup" {
  source    = "./modules/backup"
  providers = {
    aws.replica = aws.us_west
  }
}

Refresh expired credentials (re-login/assume role) before retrying.

What to watch out for

• CI needs credentials injected as secrets/OIDC — provider config that works locally will fail without them.
• Modules never inherit aliased providers implicitly; pass them via the providers map.
• Keep secrets out of .tf files — use env vars, OIDC, or a secrets backend, not literals.
• A provider that “requires explicit configuration” needs a provider block even if you rely on env credentials.

Related

• OpenTofu Error: ‘Provider configuration not present’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Invalid legacy provider address’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Error loading state: AccessDenied’ — Cause, Fix, and Troubleshooting Guide