I am trying to set up a pipeline, which is supposed to deploy terraform code into an aws account. The code works fine locally, and I have setup and imported the state bucket and dynamodb table which enables state locking.

However, when I run the code in a gitlab ci, I get the following error message:

Error: error configuring S3 Backend: no valid credential sources for S3 Backend found. │ │ Please see https://www.terraform.io/docs/language/settings/backends/s3.html │ for more information about providing credentials. │ │ Error: NoCredentialProviders: no valid providers in chain. Deprecated. │ For verbose messaging see aws.Config.CredentialsChainVerboseErrors

I export the aws credentials as variables in the before_script like so:

  - rm -rf .terraform
  - terraform --version
  - export AWS_ACCESS_KEY_ID
  - export AWS_ROLE_ARN
  - export AWS_ROLE_ARN

Is there another step that I am missing, or do I maybe have to include the credential variables in the terraform code?

3 Answers 3


The answer to this question is no. I merely forgot to export the AWS_SECRET_ACCESS_KEY variable in the before_script section.

  • :-) Funny how often I write up an answer and the brain shifts to reveal its block like I see here. Thanks for coming back and answering your own question!
    – Josiah
    May 4, 2021 at 14:53

In our terraform pipeline we use the aws cli command to assume a role and get the credential variables, the EC2 instance for the pipeline worker is using a profile which can assume the role.

creds=$(aws sts assume-role --role-arn ${ROLE_ARN} --role-session-name tf-pipeline | jq -r '.Credentials')
export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r '.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r '.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $creds | jq -r '.SessionToken')

in the case of using GitLab ci ENV var, if u are testing in branches other than main/master, make sure your variables are not PROTECTED

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.