{"record":{"id":"4d3d0257216bf44e","repo":"hashicorp/terraform","slug":"reading-client-secret-from-file-q-v","errorCode":null,"errorMessage":"reading Client Secret from file %q: %v","messagePattern":"reading Client Secret from file %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":120,"sourceCode":"\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_CLIENT_ID\") != \"\" {\n\t\taksClientId := os.Getenv(\"AZURE_CLIENT_ID\")\n\t\tif clientId != \"\" && clientId != aksClientId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\t\tclientId = aksClientId\n\t}\n\n\treturn &clientId, nil\n}\n\nfunc getClientSecret(d *backendbase.SDKLikeData) (*string, error) {\n\tclientSecret := strings.TrimSpace(d.String(\"client_secret\"))\n\n\tif path := d.String(\"client_secret_file_path\"); path != \"\" {\n\t\tfileSecretRaw, err := os.ReadFile(path)\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading Client Secret from file %q: %v\", path, err)\n\t\t}\n\n\t\tfileSecret := strings.TrimSpace(string(fileSecretRaw))\n\n\t\tif clientSecret != \"\" && clientSecret != fileSecret {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tclientSecret = fileSecret\n\t}\n\n\treturn &clientSecret, nil\n}\n\nfunc getTenantId(d *backendbase.SDKLikeData) (*string, error) {\n\ttenantId := strings.TrimSpace(d.String(\"tenant_id\"))\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_TENANT_ID\") != \"\" {","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L102-L138","documentation":"getClientSecret (helpers.go:120) reads the service-principal secret from the file named by `client_secret_file_path`. If os.ReadFile fails, the OS error is wrapped into this message.","triggerScenarios":"Configuring the azurerm backend with client_secret_file_path pointing at a path that does not exist, is unreadable, or is a directory.","commonSituations":"Kubernetes secret mount path that changed; CI env var not interpolated; file removed after a secret rotation; permission/uid mismatch on the secret file.","solutions":["Verify the path is readable: `test -r \"$client_secret_file_path\"`.","Ensure the process has permission to read the secret file.","Correct the mount path / typo.","Use client_secret directly if the value is already available in the environment."],"exampleFix":"# before\nbackend \"azurerm\" {\n  client_secret_file_path = \"/etc/azure/secret\"\n}\n# after\nbackend \"azurerm\" {\n  client_secret_file_path = \"/etc/azure/client-secret\"\n}","handlingStrategy":"validation","validationCode":"# ensure client_secret_file_path is readable\nf=\"${TF_VAR_client_secret_file_path:-}\"\n[ -z \"$f\" ] || test -r \"$f\" || { echo \"client secret file not readable: $f\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate backend file paths before init.","Restrict file permissions on secret files to the terraform runtime uid."],"tags":["azure","client-secret","config","authentication","file-io"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}