{"record":{"id":"30473c862fdffbf8","repo":"hashicorp/terraform","slug":"reading-client-id-from-file-q-v","errorCode":null,"errorMessage":"reading Client ID from file %q: %v","messagePattern":"reading Client ID from file %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":90,"sourceCode":"\n\t\tif idToken != \"\" && idToken != fileToken {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\n\t\tidToken = fileToken\n\t}\n\n\treturn &idToken, nil\n}\n\nfunc getClientId(d *backendbase.SDKLikeData) (*string, error) {\n\tclientId := strings.TrimSpace(d.String(\"client_id\"))\n\n\tif path := d.String(\"client_id_file_path\"); path != \"\" {\n\t\tfileClientIdRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client ID from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileClientId := strings.TrimSpace(string(fileClientIdRaw))\n\n\t\tif clientId != \"\" && clientId != fileClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tclientId = fileClientId\n\t}\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_CLIENT_ID\") != \"\" {\n\t\taksClientId := os.Getenv(\"AZURE_CLIENT_ID\")\n\t\tif clientId != \"\" && clientId != aksClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\t\tclientId = aksClientId\n\t}","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L72-L108","documentation":"getClientId (helpers.go:90) reads the Azure service-principal / app client ID from the file named by `client_id_file_path`. If os.ReadFile fails, the OS error is wrapped into this message.","triggerScenarios":"Configuring the azurerm backend with client_id_file_path set to a path that does not exist, is unreadable, or is a directory.","commonSituations":"Mounted-secret path that differs across environments; wrong env var interpolation in CI; the file not yet created by an init container; permission/uid mismatch.","solutions":["Check the path is readable: `test -r \"$client_id_file_path\"`.","Ensure the terraform process can read the mounted secret file.","Correct typos or an incorrect secret mount path.","Prefer setting client_id directly if the value is already available."],"exampleFix":"# before\nbackend \"azurerm\" {\n  client_id_file_path = \"/etc/azure/client\"   # missing\n}\n# after\nbackend \"azurerm\" {\n  client_id_file_path = \"/etc/azure/client-id\"\n}","handlingStrategy":"validation","validationCode":"# ensure client_id_file_path is readable\nf=\"${TF_VAR_client_id_file_path:-}\"\n[ -z \"$f\" ] || test -r \"$f\" || { echo \"client id file not readable: $f\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate backend file paths before init.","Keep client-id secrets mounted at stable, well-known paths."],"tags":["azure","client-id","config","authentication","file-io"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}