How to fix "NoCredentialProviders: no valid providers in chain. Deprecated."?

Question

Here is a terraform script I lifted from this repo

provider "aws" {
  region  = "${var.aws_region}"
  profile = "${var.aws_profile}"
}

##----------------------------
#     Get VPC Variables
##----------------------------

#-- Get VPC ID
data "aws_vpc" "selected" {
  tags = {
    Name = "${var.name_tag}"
  }
}

#-- Get Public Subnet List
data "aws_subnet_ids" "selected" {
  vpc_id = "${data.aws_vpc.selected.id}"

  tags = {
    Tier = "public"
  }
}

#--- Gets Security group with tag specified by var.name_tag
data "aws_security_group" "selected" {
  tags = {
    Name = "${var.name_tag}*"
  }
}

#--- Creates SSH key to provision server
module "ssh_key_pair" {
  source                = "git::https://github.com/cloudposse/terraform-aws-key-pair.git?ref=tags/0.3.2"
  namespace             = "example"
  stage                 = "dev"
  name                  = "${var.key_name}"
  ssh_public_key_path   = "${path.module}/secret"
  generate_ssh_key      = "true"
  private_key_extension = ".pem"
  public_key_extension  = ".pub"
}

#-- Grab the latest AMI built with packer - widows2016.json
data "aws_ami" "Windows_2016" {
  owners = [ "amazon", "microsoft" ]
  filter {
    name   = "is-public"
    values = ["false"]
  }

  filter {
    name   = "name"
    values = ["windows2016Server*"]
  }

  most_recent = true
}

#-- sets the user data script
data "template_file" "user_data" {
  template = "/scripts/user_data.ps1"
}


#---- Test Development Server
resource "aws_instance" "this" {
  ami                  = "${data.aws_ami.Windows_2016.image_id}"
  instance_type        = "${var.instance}"
  key_name             = "${module.ssh_key_pair.key_name}"
  subnet_id            = "${data.aws_subnet_ids.selected.ids[01]}"
  security_groups      = ["${data.aws_security_group.selected.id}"]
  user_data            = "${data.template_file.user_data.rendered}"
  iam_instance_profile = "${var.iam_role}"
  get_password_data    = "true"

  root_block_device {
    volume_type           = "${var.volume_type}"
    volume_size           = "${var.volume_size}"
    delete_on_termination = "true"
  }

  tags {
    "Name"    = "NEW_windows2016"
    "Role"    = "Dev"
  }

  #--- Copy ssh keys to S3 Bucket
  provisioner "local-exec" {
    command = "aws s3 cp ${path.module}/secret s3://PATHTOKEYPAIR/ --recursive"
  }

  #--- Deletes keys on destroy
  provisioner "local-exec" {
    when    = "destroy"
    command = "aws s3 rm 3://PATHTOKEYPAIR/${module.ssh_key_pair.key_name}.pem"
  }

  provisioner "local-exec" {
    when    = "destroy"
    command = "aws s3 rm s3://PATHTOKEYPAIR/${module.ssh_key_pair.key_name}.pub"
  }
}

When I tun terraform plan I got this error message:

Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.template_file.user_data: Refreshing state...

Error: Error refreshing state: 1 error(s) occurred:

* provider.aws: error validating provider credentials: error calling sts:GetCallerIdentity: NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors

score 6 · Answer 1 · answered Mar 04 '21 at 08:35

6

Double check the format of your ~/.aws/credential file.

In my case, the credentials used the following format :

[profile]
AWS_ACCESS_KEY_ID=xxxx
AWS_SECRET_ACCESS_KEY=yyyy

changing it to the following fixed the issue :

[profile]
aws_access_key_id = xxxx
aws_secret_access_key = yyyy

answered Mar 04 '21 at 08:35

Orabîg

180
2
10

1

You've got to be kidding me. This fixed it. Good job to whoever wrote the aws module... not... what a joke. – Rob Jun 06 '22 at 23:16
I think that the issue comes from the fact that the specifications for this file are not very clear, and thus they were interpreted differently by different implementations. So, sometimes users hit the wall when a valid file is suddenly not accepted. – Orabîg Jun 14 '22 at 20:05

score 6 · Accepted Answer · answered Jul 04 '19 at 06:21

6

I think you missed access and secret keys. Try something like below. If you are not passing import as variable.

provider "aws" {
  region  = "${var.region}"
  profile = "${var.profile}"   
  access_key=********
  secret_key=********
}

answered Jul 04 '19 at 06:21

asktyagi

2,401
1
5
19

1

I use `export AWS_ACCESS_KEY_ID=xxx` and `export AWS_SECRET_ACCESS_KEY=yyy` instead. But it fixes the issue. Thanks! – Anthony Kong Jul 04 '19 at 06:27
3

Don't store your keys in the terraform files. Static Credentials Warning: Hard-coding credentials into any Terraform configuration is not recommended, and risks secret leakage should this file ever be committed to a public version control system. -from Hashicorp documentation. – jorfus Nov 05 '20 at 01:27

How to fix "NoCredentialProviders: no valid providers in chain. Deprecated."?

2 Answers2