Terraform "error configuring S3 Backend: no valid credential sources" in CI

The S3 backend could not find AWS credentials during init. Unlike the AWS provider, the backend authenticates at init time - so a missing role or unset keys stops you before any plan runs.

What this error means

terraform init fails configuring the S3 backend with "no valid credential sources found", before providers or state are touched. It is environment-specific: it works locally with your profile but fails on a bare runner with no credentials.

terraform init output

Error: error configuring S3 Backend: no valid credential sources for S3 Backend
found.

Please see https://www.terraform.io/docs/language/settings/backends/s3.html
for more information about providing credentials.

Common causes

No AWS credentials available at init

The runner has no assumed role, no environment keys, and no profile. The S3 backend authenticates during init, so it fails immediately.

OIDC role not assumed before init

If configure-aws-credentials (or id-token: write) is missing or runs after init, the backend has no role to use when it needs one.

How to fix it

Assume the role before init

Wire up OIDC (or inject credentials) in a step that runs before terraform init.

.github/workflows/ci.yml

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/ci-terraform
    aws-region: us-east-1
- run: terraform init -input=false

Verify credentials are in effect

Run aws sts get-caller-identity in the same job before init to confirm a role/identity exists.
Ensure the credentials step runs before terraform init, not after.
Confirm the role can reach the backend bucket and region.

How to prevent it

Configure AWS credentials (OIDC role) before the init step.
Assert identity with aws sts get-caller-identity early in CI.
Keep the backend region consistent via -backend-config.