Terraform registry "403 / 429" provider download in CI

init downloads providers from registry.terraform.io (and its release host). A 429 (too many requests) or transient 403 from that endpoint blocks the download even though the config is valid.

What this error means

init fails installing a provider with an HTTP 403 or 429 from registry.terraform.io or releases.hashicorp.com. Reruns often succeed, marking it a transient rate-limit/network condition rather than a config issue.

terraform

Error: Failed to install provider

Error while installing hashicorp/aws v5.60.0: could not query provider registry
for registry.terraform.io/hashicorp/aws: the request failed after 2 attempts,
please try again later: Get "https://releases.hashicorp.com/...": 429 Too Many
Requests

Common causes

Registry rate limiting (429)

Many concurrent CI jobs (or a shared egress IP) pulling providers can trip the registry rate limit, returning 429.

Transient 403 / network hiccup

A momentary registry or CDN issue, or a proxy interfering with the request, can return a transient 403 on download.

How to fix it

Retry, cache providers, and use a mirror

Re-run init; reduce registry hits by caching the plugin directory or configuring a provider mirror.

Terminal

export TF_PLUGIN_CACHE_DIR="$HOME/.terraform.d/plugin-cache"
mkdir -p "$TF_PLUGIN_CACHE_DIR"
terraform init -input=false

Reduce registry pressure

Set TF_PLUGIN_CACHE_DIR (cached across jobs) so providers download once.
Configure a network mirror for providers to avoid the public registry.
Stagger many concurrent init jobs sharing one egress IP.

How to prevent it

Use a provider plugin cache or network mirror in CI.
Avoid stampeding the public registry from many concurrent jobs.
Run init on a platform that auto-retries transient registry errors.