terraform config_error ai_generated true

Error: Invalid provider configuration: The given AWS account ID is not valid

ID: terraform/invalid-aws-account-id-in-provider

Also available as: JSON · Markdown · 中文
88%Fix Rate
82%Confidence
1Evidence
2024-01-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.5.0 active — — —
1.6.0 active — — —
1.7.0 active — — —
1.8.0 active — — —

Root Cause

The allowed_account_ids or forbidden_account_ids in the AWS provider configuration contains a malformed or incorrect AWS account ID.

generic

中文

AWS 提供程序配置中的 allowed_account_ids 或 forbidden_account_ids 包含格式错误或不正确的 AWS 账户 ID。

Official Documentation

https://registry.terraform.io/providers/hashicorp/aws/latest/docs#allowed_account_ids

Workarounds

  1. 95% success Verify the correct AWS account ID using AWS CLI: aws sts get-caller-identity --query Account. Then update the provider block: provider "aws" { allowed_account_ids = ["123456789012"] } 
    Verify the correct AWS account ID using AWS CLI: aws sts get-caller-identity --query Account. Then update the provider block: provider "aws" { allowed_account_ids = ["123456789012"] }
  2. 90% success If using environment variables, ensure AWS_ACCOUNT_ID is set correctly: export AWS_ACCOUNT_ID=123456789012. Then reference it in provider: allowed_account_ids = [var.aws_account_id] 
    If using environment variables, ensure AWS_ACCOUNT_ID is set correctly: export AWS_ACCOUNT_ID=123456789012. Then reference it in provider: allowed_account_ids = [var.aws_account_id]
  3. 85% success Remove the allowed_account_ids or forbidden_account_ids line if account restriction is not needed, and rely on IAM policies instead. 
    Remove the allowed_account_ids or forbidden_account_ids line if account restriction is not needed, and rely on IAM policies instead.

中文步骤

  1. 使用 AWS CLI 验证正确的 AWS 账户 ID：aws sts get-caller-identity --query Account。然后更新提供程序块：provider "aws" { allowed_account_ids = ["123456789012"] }
  2. 如果使用环境变量，请确保正确设置 AWS_ACCOUNT_ID：export AWS_ACCOUNT_ID=123456789012。然后在提供程序中引用它：allowed_account_ids = [var.aws_account_id]
  3. 如果不需要账户限制，请删除 allowed_account_ids 或 forbidden_account_ids 行，并依赖 IAM 策略。

Dead Ends

Common approaches that don't work:

  1. Remove the allowed_account_ids line entirely without checking the account ID format. 70% fail

    This removes a security safeguard and may allow operations on unintended accounts.

  2. Use a random 12-digit number as the account ID. 100% fail

    The account ID must match the actual AWS account being used. Random numbers will fail validation.

  3. Switch to using IAM roles without specifying account IDs. 60% fail

    This only works if the role is correctly set up; the error is about the account ID format, not the role.