Terraform ignoring credentials in ~/.terraformrc

Question

I have the following ~/.terraformrc file:

credentials "myprivategitlab.com" {
token = "XAXAXAXAXAXAX"  
}

Now, when I switch to my terraform directory I cannot initialize the HTTP Backend I´ve configured. It´s a remote state in my gitlab:

terraform {
  backend "http" {
    address = "https://myprivategitlab.com/api/v4/projects/123/terraform/state/test"
    lock_address = "https://myprivategitlab.com/api/v4/projects/123/terraform/state/test/lock"
    unlock_address = "https://myprivategitlab.com/api/v4/projects/123/terraform/state/test/lock"
    lock_method = "POST"
    unlock_method = "DELETE"
    retry_wait_min = "5"
  }
}

I get the following error:

Initializing the backend...

Successfully configured the backend "http"! Terraform will automatically use this backend unless the backend configuration changes. Error refreshing state: HTTP remote state endpoint requires auth

When I add "password" with the api token to the backend configuration it works. How do I get the credentials from the configuration file to work?

Answer 1

credentials blocks in the CLI configuration are for Terraform-native services only. The http backend is specifically for interacting with non-Terraform-native HTTP servers which don't participate in Terraform's usual service discovery mechanism, and thus also can't participate in its host-based token management.

Refer to the http backend's own documentation to learn about the options available for that backend. At the time of writing, the option for passing credentials outside of the configuration is to set the TF_HTTP_USERNAME and TF_HTTP_PASSWORD environment variables when running Terraform.

Alternatively, the relevant GitLab documentation recommends passing credentials on the terraform init command line, which is effectively the same as setting them in the configuration itself as far as Terraform is concerned. Unlike when using environment variables, Terraform will save credentials passed on the command line in a file under the .terraform directory, and so those credentials will persist between runs inside that working directory.