{"record":{"id":"0b74b3710531bcb3","repo":"hashicorp/terraform","slug":"unable-to-determine-credentials-file-path-s","errorCode":null,"errorMessage":"unable to determine credentials file path: %s","messagePattern":"unable to determine credentials file path: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/credentials.go","lineNumber":328,"sourceCode":"\t\t// Delegate entirely to the helper, then.\n\t\tif new == nil {\n\t\t\treturn s.helper.ForgetForHost(host)\n\t\t}\n\t\treturn s.helper.StoreForHost(host, new)\n\tdefault:\n\t\t// Should never happen because the above cases are exhaustive\n\t\treturn fmt.Errorf(\"invalid credentials location %#v\", loc)\n\t}\n}\n\nfunc (s *CredentialsSource) updateLocalHostCredentials(host svchost.Hostname, new svcauth.HostCredentialsWritable) error {\n\t// This function updates the local credentials file in particular,\n\t// regardless of whether a credentials helper is active. It should be\n\t// called only indirectly via updateHostCredentials.\n\n\tfilename, err := s.CredentialsFilePath()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to determine credentials file path: %s\", err)\n\t}\n\n\toldSrc, err := ioutil.ReadFile(filename)\n\tif err != nil && !os.IsNotExist(err) {\n\t\treturn fmt.Errorf(\"cannot read %s: %s\", filename, err)\n\t}\n\n\tvar raw map[string]interface{}\n\n\tif len(oldSrc) > 0 {\n\t\t// When decoding we use a custom decoder so we can decode any numbers as\n\t\t// json.Number and thus avoid losing any accuracy in our round-trip.\n\t\tdec := json.NewDecoder(bytes.NewReader(oldSrc))\n\t\tdec.UseNumber()\n\t\terr = dec.Decode(&raw)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot read %s: %s\", filename, err)\n\t\t}","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/cliconfig/credentials.go#L310-L346","documentation":"Emitted by `updateLocalHostCredentials` (credentials.go:328) when `s.CredentialsFilePath()` returns an error while trying to store/forget credentials. In the current implementation `CredentialsFilePath` simply returns the stored `credentialsFilePath` with a nil error, so this is a defensive guard for future changes; today it is effectively unreachable unless the field was unset/invalid.","triggerScenarios":"Calling `StoreForHost`/`ForgetForHost` (e.g. via `terraform login`/`terraform logout`) on a `CredentialsSource` whose internal `credentialsFilePath` could not be resolved. Reachable only if `CredentialsFilePath()` is extended to fail or the source was constructed without a path.","commonSituations":"Constructing a `CredentialsSource` via an unconventional path that leaves `credentialsFilePath` empty; test harnesses that bypass `CredentialsConfigFile()`. End users essentially never see this.","solutions":["Ensure Terraform is invoked with a resolvable home/config dir so `CredentialsConfigFile()` succeeds (see error 554).","If embedding Terraform internals, always build the source via `Config.CredentialsSource` rather than constructing it directly.","Re-run `terraform login` after fixing `HOME`/`TF_CLI_CONFIG_FILE`."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Defensive: ensure CredentialsFilePath resolves before store/forget.\nif _, err := src.CredentialsFilePath(); err != nil {\n    return fmt.Errorf(\"cannot proceed with credential update: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// if err := src.StoreForHost(host, creds); err != nil {\n//     if strings.Contains(err.Error(), \"unable to determine credentials file path\") {\n//         // rebuild the CredentialsSource via Config.CredentialsSource\n//     }\n// }","preventionTips":["Construct CredentialsSource only via `Config.CredentialsSource`, never by hand.","Ensure the home/config dir is resolvable so the path is populated.","Treat this error as a near-bug and report it if reproducible."],"tags":["terraform","cli-config","credentials","internal","defensive"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}