Providing Terraform with credentials in terraform files instead of env variable

Question

I have set-up a terraform project with a remote back-end on GCP. Now when I want to deploy the infrastructure, I run into issues with credentials. I have a credentials file in

\home\mike\.config\gcloud\credentials.json

In my terraform project I have the following data referring to the remote state:

data "terraform_remote_state" "project_id" {
   backend   = "gcs"
   workspace = "${terraform.workspace}"

   config {
     bucket = "${var.bucket_name}"
     prefix = "${var.prefix_project}"
   }
}

and I specify the cloud provider with a the details of my credentials file.

provider "google" {
  version     = "~> 1.16"
  project     = "${data.terraform_remote_state.project_id.project_id}"
  region      = "${var.region}"
  credentials = "${file(var.credentials)}"
}

However, this runs into

data.terraform_remote_state.project_id: data.terraform_remote_state.project_id: 
error initializing backend:
storage.NewClient() failed: dialing: google: could not find default 
credentials.

if I add

export GOOGLE_APPLICATION_CREDENTIALS=/home/mike/.config/gcloud/credentials.json

I do get it to run as desired. My issue is that I would like to specify the credentials in the terraform files as I am running the terraform commands in an automated way from a python script where I cannot set the environment variables. How can I let terraform know where the credentials are without setting the env variable?

Vishwas M.R · Accepted Answer · 2025-11-05 06:57:50Z

22

I was facing the same error when trying to run terraform (version 1.1.5) commands in spite of having successfully authenticated via gcloud auth login.

Error message in my case:

Error: storage.NewClient() failed: dialing: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

It turned out that I also had to authenticate via gcloud auth application-default login and was able to run Terraform commands thereafter.

---

This is because of the following subtle difference between the two commands:

gcloud auth login: Authenticates a user for gcloud and gsutil CLI commands.

gcloud auth application-default login: Authenticates applications (like Terraform, SDKs, or scripts) using Application Default Credentials (ADC).

edited Nov 5 at 6:57

answered Mar 3, 2022 at 11:44

Vishwas M.R

1,7192 gold badges20 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mike · Accepted Answer · 2020-02-07 13:53:27Z

7

I figured this out in the end.

Also the data needs to have the credentials.

E.g.

data "terraform_remote_state" "project_id" {
  backend   = "gcs"
  workspace = "${terraform.workspace}"

  config = {
    bucket = "${var.bucket_name}"
    prefix = "${var.prefix_project}"
    credentials = "${var.credentials}"  <- added
  }
}

edited Feb 7, 2020 at 13:53

answered Mar 8, 2019 at 19:48

Mike

4,35914 gold badges48 silver badges87 bronze badges

1 Comment

Zach Olinske Over a year ago

missing config = {

Eng. Atwijukire · Accepted Answer · 2023-08-31 12:18:39Z

2

Provide the service account credentials:

terraform {

  backend "gcs" {
    credentials = "myserviceaccount-credentials-file.json"
    bucket = "my-project-global-bucket"
    prefix = "terraform/state"
  }

}

answered Aug 31, 2023 at 12:18

Eng. Atwijukire

9337 silver badges11 bronze badges

1 Comment

Nataraj Over a year ago

It works for terraforrm backend .

Collectives™ on Stack Overflow

Providing Terraform with credentials in terraform files instead of env variable

3 Answers 3

Comments

1 Comment

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related