🚨 OpenTofu Error: 'Unsupported argument' — Cause, Fix, and Troubleshooting Guide

What this error means

Every resource, data source, and module accepts a fixed set of arguments defined by its schema. If you set an argument the schema does not recognize — a typo, a removed field, or one that belongs in a nested block — OpenTofu rejects the configuration:

Error: Unsupported argument

  on main.tf line 15, in resource "aws_s3_bucket" "logs":
  15:   acl = "private"

An argument named "acl" is not expected here.

How it presents

• tofu validate/plan fails with Unsupported argument and the offending line.
• The message says the argument “is not expected here.”
• It commonly appears after a major provider upgrade that removed or relocated a field.
• Also appears from module calls that pass a variable the module does not declare.

Tracing the connection

Read the line OpenTofu flags, then check the current schema for that resource:

tofu validate
tofu providers schema -json | jq '.provider_schemas | keys'

Inspect the exact attributes a resource type supports:

tofu providers schema -json \
  | jq '.provider_schemas["registry.opentofu.org/hashicorp/aws"].resource_schemas["aws_s3_bucket"].block.attributes | keys'

For a module call, list the variables the module actually declares:

grep -rn 'variable ' modules/logging/

Network path causes

• Typo — instace_type instead of instance_type.
• Removed argument after a provider major bump — e.g., inline acl on aws_s3_bucket moved to a separate aws_s3_bucket_acl resource.
• Wrong nesting — the argument belongs inside a nested block, not at the top level.
• Module input not declared — passing foo = ... to a module with no variable "foo".
• Copied config for a different resource type with a similar but not identical schema.

Remediation steps

Fix a typo to match the schema attribute name exactly:

resource "aws_instance" "web" {
  instance_type = "t3.micro"   # was instace_type
}

Migrate a removed argument to its new form. For AWS S3 ACLs after provider v4+:

resource "aws_s3_bucket" "logs" {
  bucket = "example-logs"
}

resource "aws_s3_bucket_acl" "logs" {
  bucket = aws_s3_bucket.logs.id
  acl    = "private"
}

Move the argument into the correct nested block if the schema nests it:

resource "aws_launch_template" "web" {
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size = 20
    }
  }
}

Declare the module variable if you meant to pass a new input:

# modules/logging/variables.tf
variable "retention_days" {
  type = number
}

Keeping the path healthy

• Read provider upgrade guides before a major bump — removed/relocated arguments are the top source of this error.
• tofu providers schema -json is the source of truth for what a resource accepts; grep it instead of guessing.
• Module inputs must be declared with variable blocks; an undeclared input is “unsupported.”
• Pin provider versions so a schema change does not appear unexpectedly on the next init -upgrade.

Related connectivity errors

• OpenTofu Error: ‘Missing required argument’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Reference to undeclared resource’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Unsuitable value type’ — Cause, Fix, and Troubleshooting Guide