{"record":{"id":"404bb1d757d14bc2","repo":"hashicorp/terraform","slug":"error-loading-credentials-s","errorCode":null,"errorMessage":"Error loading credentials: %s","messagePattern":"Error loading credentials: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/gcs/backend.go","lineNumber":198,"sourceCode":"\t\t\tAccessToken: v,\n\t\t})\n\t} else if v := data.String(\"credentials\"); v != \"\" {\n\t\tcreds = v\n\t} else if v := os.Getenv(\"GOOGLE_BACKEND_CREDENTIALS\"); v != \"\" {\n\t\tcreds = v\n\t} else {\n\t\tcreds = os.Getenv(\"GOOGLE_CREDENTIALS\")\n\t}\n\n\tif tokenSource != nil {\n\t\tcredOptions = append(credOptions, option.WithTokenSource(tokenSource))\n\t} else if creds != \"\" {\n\n\t\t// to mirror how the provider works, we accept the file path or the contents\n\t\tcontents, err := readPathOrContents(creds)\n\t\tif err != nil {\n\t\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\t\tfmt.Errorf(\"Error loading credentials: %s\", err),\n\t\t\t)\n\t\t}\n\n\t\tif !json.Valid([]byte(contents)) {\n\t\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\t\tfmt.Errorf(\"the string provided in credentials is neither valid json nor a valid file path\"),\n\t\t\t)\n\t\t}\n\n\t\tcredOptions = append(credOptions, option.WithCredentialsJSON([]byte(contents)))\n\t}\n\n\t// Service Account Impersonation\n\tif v := data.String(\"impersonate_service_account\"); v != \"\" {\n\t\tServiceAccount := v\n\t\tvar delegates []string\n\n\t\tdelegatesVal := data.GetAttr(\"impersonate_service_account_delegates\", cty.List(cty.String))","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/gcs/backend.go#L180-L216","documentation":"Raised by the GCS backend when readPathOrContents(creds) fails — i.e. the 'credentials' value looked like a file path but the file could not be opened or read. The backend accepts credentials either as an inline JSON blob or as a path to a JSON key file; this error specifically means a path was attempted and the read failed. The wrapped %s is the underlying os/io error.","triggerScenarios":"At backend.go:195-199: readPathOrContents returns an error. Triggered when 'credentials' (or GOOGLE_BACKEND_CREDENTIALS / GOOGLE_CREDENTIALS) is a string that is not pure JSON, so readPathOrContents treats it as a path, but the path does not exist or is unreadable.","commonSituations":"credentials path is relative and terraform runs from a different working directory; the key file was deleted/renamed; path has a typo; file permissions deny the terraform process; GOOGLE_CREDENTIALS points to a stale path after key rotation.","solutions":["Verify the path exists and is readable by the terraform process: 'cat <path>' or 'test -r <path>'.","Use an absolute path for 'credentials' to avoid working-directory issues.","If you meant to inline the JSON, ensure the value is valid JSON (then error 219 would not apply) — do not paste a path that does not resolve.","After key rotation, update the path/env var to the new key file."],"exampleFix":"# before: relative path that fails from another cwd\ncredentials = \"./keys/sa.json\"\n# after: absolute path\ncredentials = \"/home/user/project/keys/sa.json\"\n# verify\ntest -r /home/user/project/keys/sa.json && echo ok","handlingStrategy":"validation","validationCode":"// Validate the credentials path before init.\nfunc validateCredsPath(creds string) error {\n    // if it doesn't parse as JSON, it must be a readable file\n    if json.Valid([]byte(creds)) { return nil }\n    info, err := os.Stat(creds)\n    if err != nil { return fmt.Errorf(\"credentials path %q: %w\", creds, err) }\n    if info.IsDir() { return fmt.Errorf(\"credentials path is a directory: %q\", creds) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use an absolute path for 'credentials'.","Confirm the file is readable by the terraform process ('test -r <path>').","Update paths after key rotation."],"tags":["gcs","google-cloud","credentials","config","file","auth"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}