TFE provider: Error reading configuration of membership ou-xxxxxxxxxxxx: unauthorized

Terraform HCP Terraform
1

When I am running terraform plan to manage terraform cloud, its fails with

Error: Error reading configuration of membership ou-xxxxxxxxxxxx: unauthorized

This is my provider config:

terraform {
  cloud {
    organization = "wyssmann-com"

    workspaces {
      name = "tfcloud-workspace"
    }
  }

  required_providers {
    tfe = {
      source = "hashicorp/tfe"
    }
  }
}

provider "tfe" {
  hostname = "app.terraform.io" # Terraform Cloud
  # token    = var.token
}

Following Authentication I tried the following

  • having a variable TFE_TOKEN

  • having a variable TF_VAR_TFE_TOKEN

  • using a variable.tfvars file

    token = "xxxxx"

I re-created the token several times, but I never get it running

Initializing plugins and modules...
tfe_organization_membership.demo_papanito: Refreshing state... [id=ou-xxxxxxxxxxxxxxxxxxx]
tfe_organization_membership.papanito_papanito: Refreshing state... [id=ou-yyyyyyyyyyyyyyyyyyy]
tfe_organization.papanito: Refreshing state... [id=papanito]
tfe_organization.demo: Refreshing state... [id=demo-com]
╷
│ Error: unauthorized
│ 
│   with tfe_organization.demo,
│   on demo-com.tf line 1, in resource "tfe_organization" "demo":
│    1: resource "tfe_organization" "demo" {
│ 
╵
╷
│ Error: Error reading configuration of membership ou-xxxxxxxxxxxxxxxxxxx: unauthorized
│ 
│   with tfe_organization_membership.demo_papanito,
│   on demo-com.tf line 8, in resource "tfe_organization_membership" "demo_papanito":
│    8: resource "tfe_organization_membership" "demo_papanito" {
│ 
╵
╷
│ Error: unauthorized
│ 
│   with tfe_organization.papanito,
│   on papanito.tf line 1, in resource "tfe_organization" "papanito":
│    1: resource "tfe_organization" "papanito" {
│ 
╵
╷
│ Error: Error reading configuration of membership ou-yyyyyyyyyyyyyyyyyyy: unauthorized
│ 
│   with tfe_organization_membership.papanito_papanito,
│   on papanito.tf line 9, in resource "tfe_organization_membership" "papanito_papanito":
│    9: resource "tfe_organization_membership" "papanito_papanito" {
│ 
╵
Operation failed: failed running terraform plan (exit 1)
2

Never mind, I can make it work using variables and .tfvars


variable "token" {}

provider "tfe" {
  hostname = "app.terraform.io" # Terraform Cloud
  token = var.token
}
3

Hi @papanito,

Sorry I didn’t see this sooner.

I think the problem in your original case is that Terraform Cloud itself issues an auth token to every run automatically, with the run effectively authenticating as the workspace itself, so that e.g. it can save its own state using the Terraform Cloud API. I think the automatic token was superseding the one you tried to set.

Configuring the provider using input variables instead is a reasonable way to provide a separate API token for just the provider’s use though, indeed.

1 Like