Question
Terraform Provider Authentication: Credential Expiration and Token Refresh Behavior
Ash Nova
0 reputation · 09 Oct 2020, 15:23 UTC
143K views1
Loading…
0 reputation · 09 Oct 2020, 15:23 UTC
Implementing least-privilege access in Terraform often involves using short-lived credentials via OIDC or IAM roles to minimize the risk of long-lived secret leakage. While this architecture reduces the blast radius of a compromise, it introduces dependencies on the credential lifecycle during long-running operations.
There is uncertainty regarding how different provider implementations handle token expiration during the execution of a terraform apply. Specifically, it is unclear if the provider automatically requests a new token from the identity provider upon receiving an authentication error, or if the process fails immediately, requiring a manual restart of the execution.
35775 reputation · 09 Oct 2020, 18:17 UTC
Terraform core does not provide a universal token‑renewal mechanism. Whether a provider automatically obtains a new short‑lived credential when the current one expires depends entirely on the provider’s implementation.
terraformConfigure phase and again just before each resource action (create, read, update, delete) is dispatched.Because refresh logic is provider‑specific, some older versions or community‑maintained providers may lack automatic retry logic and will fail immediately on an expired token. Documentation varies, and the exact HTTP status codes that trigger a refresh (401 vs. 403) can differ between releases.
export TF_LOG=DEBUG and export TF_LOG_PATH=tf.log.terraform apply (or terraform plan) targeting a resource that will trigger an API call after the credential’s TTL expires.[DEBUG] Provider: received 401 Unauthorized[DEBUG] Provider: attempting token refresh[DEBUG] Provider: retrying request with new tokenauth_refresh, token_ttl, or retry_on_failure to confirm or adjust the behavior.To give a definitive recommendation, please specify which Terraform provider (e.g., hashicorp/aws, hashicorp/azurerm, hashicorp/google) and its version you are using, as refresh behavior has changed between major releases.
Use comments to ask for clarification. Post a solution as an answer.
35,775 reputation · 09 Oct 2020, 21:47 UTC
In a typical provider (AWS, Azure, GCP), the underlying SDK checks the token’s expiry just before each API call. If the token is stale, the SDK automatically invokes the identity endpoint (e.g., AssumeRoleWithWebIdentity, GetToken) and retries the request with the new credential.
Terraform core only retries on transient network or server‑side errors. It does not re‑invoke the provider’s Configure step when an authentication error occurs. Therefore, if the provider’s SDK does not perform an automatic refresh, the terraform apply will abort at the first 401/403 it encounters.
To avoid manual restarts, ensure you’re using a provider version that implements SDK‑level token renewal and that your identity endpoint is reachable throughout the apply.