{"record":{"id":"0cf962524d71a1ca","repo":"hashicorp/terraform","slug":"cannot-set-mode-for-credentials-file-s-s","errorCode":null,"errorMessage":"cannot set mode for credentials file %s: %s","messagePattern":"cannot set mode for credentials file (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/command/cliconfig/credentials.go","lineNumber":433,"sourceCode":"\t\t_, err = f.Write(newSrc)\n\t\tf.Close()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot write to temporary file %s: %s\", tmpName, err)\n\t\t}\n\n\t\t// Temporary file now replaces the original file, as atomically as\n\t\t// possible. (At the very least, we should not end up with a file\n\t\t// containing only a partial JSON object.)\n\t\terr = replacefile.AtomicRename(tmpName, filename)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to replace %s with temporary file %s: %s\", filename, tmpName, err)\n\t\t}\n\n\t\t// Credentials file should be readable only by its owner. (This may\n\t\t// not be effective on all platforms, but should at least work on\n\t\t// Unix-like targets and should be harmless elsewhere.)\n\t\tif err := os.Chmod(filename, 0600); err != nil {\n\t\t\treturn fmt.Errorf(\"cannot set mode for credentials file %s: %s\", filename, err)\n\t\t}\n\n\t\tmoved = true\n\t}\n\n\tif new != nil {\n\t\ts.configured[host] = new.ToStore()\n\t} else {\n\t\tdelete(s.configured, host)\n\t}\n\n\treturn nil\n}\n\n// ReadHostsInCredentialsFile discovers which hosts have credentials configured\n// in the credentials file specifically, as opposed to in any other CLI\n// config file.\n//","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/command/cliconfig/credentials.go#L415-L451","documentation":"Thrown after the atomic rename succeeded but os.Chmod(filename, 0600) failed. Terraform enforces owner-only permissions on the credentials file (it contains tokens). The data is already correctly written and in place; this error means only the permission tightening failed — common on filesystems that do not support the requested mode.","triggerScenarios":"Credentials file lives on a filesystem that does not honor Unix permission bits (FAT/exFAT, some CIFS shares); the file was replaced but is now owned by a different uid so the caller cannot chmod it; a Windows environment where 0600 has no meaning.","commonSituations":"TF_CLI_CONFIG_FILE on a USB stick or FAT-formatted partition; CIFS mount with `noperm`/`mode=0777`; running as one user but the file was chown'd to another; WSL accessing a Windows filesystem.","solutions":["Move the credentials file to a POSIX-compliant local filesystem and update TF_CLI_CONFIG_FILE / HOME accordingly.","If on Windows/WSL, use a path under the native Linux filesystem (e.g. /home/$USER) rather than /mnt/c.","If the file is owned by another user, fix ownership: `sudo chown $USER <file>` then retry.","If you must use a non-POSIX mount, accept that Terraform cannot enforce 0600 there and relocate the file."],"exampleFix":"// before: TF_CLI_CONFIG_FILE points at /mnt/c/.../credentials.tfrc.json (NTFS)\n// $ export TF_CLI_CONFIG_FILE=$HOME/.terraform.d/credentials.tfrc.json\n// after: chmod 0600 succeeds on the ext4 home volume","handlingStrategy":"validation","validationCode":"func chmodSupported(path string) bool {\n    var s syscall.Statfs_t\n    if syscall.Statfs(path, &s) != nil { return true } // assume yes if unknown\n    switch s.Type {\n    case 0x4d44, 0x65735546: // MSDOS, exFAT — non-exhaustive\n        return false\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store the credentials file on a POSIX filesystem (ext4, apfs, xfs).","Avoid FAT/exFAT and permissive CIFS mounts for credentials.","On WSL, use the native Linux home, not /mnt/c."],"tags":["credentials","filesystem","permissions","chmod","security"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}