🧱 Pulumi Error: 'invalid provider configuration' / Missing Required Provider Argument

Exact Error Message

error: aws:index/provider:Provider resource 'useast1' has a problem: invalid provider configuration
    error: missing required property 'region'
    on Pulumi program with resource urn:pulumi:prod::app::pulumi:providers:aws::useast1

A closely related form appears when a resource points at a provider that itself failed to configure:

error: rpc error: code = Unknown desc = invalid provider configuration:
  no valid credential sources for AWS Provider found.

What It Means

When you create an explicit provider (for example new aws.Provider(...)), Pulumi must configure that provider plugin before any resource that uses it can be created. If a required argument is missing or invalid — no region, an empty credential, a malformed endpoint — the provider fails to configure and every resource attached to it fails with invalid provider configuration.

Unlike the default provider, which reads ambient environment variables and Pulumi config automatically, an explicit provider only uses the arguments you pass to its constructor plus any it can resolve itself. Forgetting a required field is the most common trigger, especially when you use multiple providers (multi-region, multi-account) and expect implicit config to fill the gaps.

Common Causes

• A required provider argument (such as AWS region, GCP project, or Kubernetes kubeconfig) was omitted from the explicit provider constructor.
• Credentials the provider expects are not present in the environment or not passed explicitly.
• A config value resolved to undefined/empty because a pulumi config key was never set.
• The resource’s provider option points at a provider object that itself failed to configure.
• A typo in a provider argument name, so the value is silently ignored and a required field stays unset.
• Using an alias/second provider for another region/account without supplying its distinct credentials.

Diagnostic Commands

List the config keys the stack currently has, to see whether the value the provider needs is set:

pulumi config

Preview with detailed logging to see the provider-configure RPC and the missing property:

pulumi preview --logtostderr -v=9 2>&1 | grep -i provider

Confirm ambient credentials/region the default provider would have used (AWS example):

aws configure list
echo "$AWS_REGION"

Set the missing config value the program reads for the provider:

pulumi config set aws:region us-east-1

Step-by-Step Resolution

1. Pass every required argument explicitly to the provider constructor. For AWS, region is mandatory:

const useast1 = new aws.Provider("useast1", {
  region: "us-east-1",
});

2. Wire the provider onto each resource that must use it with the provider resource option:

const bucket = new aws.s3.Bucket("data", {}, { provider: useast1 });

3. If the value comes from stack config, read it with a required accessor so a missing key fails clearly instead of passing undefined:

const cfg = new pulumi.Config("aws");
const provider = new aws.Provider("useast1", {
  region: cfg.require("region"),
});

4. For an explicit provider that needs credentials different from the ambient ones, supply them directly (or set the provider-specific env vars before running):

const staging = new aws.Provider("staging", {
  region: "eu-west-1",
  profile: "staging-account",
});

5. Re-run the preview and confirm the provider configures and resources plan cleanly:

pulumi preview

Prevention

• Treat required provider arguments as non-optional: set region/project/kubeconfig explicitly for every explicit provider rather than relying on ambient defaults.
• Use cfg.require(...) (not cfg.get(...)) for provider inputs so missing config fails at preview instead of at resource creation.
• Keep provider credentials for each account/region distinct and passed explicitly when you run multiple providers.
• Add a validation step in CI (pulumi preview) that fails fast on unconfigured providers before up.
• Double-check argument names against the provider’s API docs; a typo means the field stays unset silently.

Related Errors

• no valid credential sources found — credentials missing for a provider that otherwise has its required args.
• unknown provider type — the provider plugin is not installed, distinct from a misconfigured one.
• resource provider version mismatch — a plugin-version problem rather than an argument problem.
• missing required configuration key — a pulumi config require failure the program raised before the provider.

Frequently Asked Questions

Why does the default provider work but my explicit provider does not? The default provider auto-reads environment variables and Pulumi config, while an explicit new aws.Provider(...) only uses the arguments you pass plus what it can resolve itself. Supply region and credentials explicitly.

Which arguments are required? It depends on the provider — AWS needs region, GCP needs project, Kubernetes needs a kubeconfig or in-cluster context. Check the provider’s API reference and pass them in the constructor.

How do I use one provider for a resource? Set the provider resource option, for example { provider: myProvider }, on each resource that must use that explicit provider instead of the default.

How do I stop config typos from causing this? Use cfg.require("region") instead of cfg.get(...), so a missing key throws a clear error at preview. Ready-made multi-provider prompts are in the Pulumi prompt library.

Can I have two providers for the same cloud? Yes — create multiple explicit providers (for different regions or accounts) and attach each to the relevant resources, giving each its own required args and credentials. More patterns are in the Pulumi guides.