{"record":{"id":"623ed0dcdecb5cac","repo":"hashicorp/nomad","slug":"s-provider-cannot-use-the-env-block","errorCode":null,"errorMessage":"%s provider cannot use the env block","messagePattern":"(.+?) provider cannot use the env block","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":10648,"sourceCode":"\tif s.Name == \"\" {\n\t\t_ = multierror.Append(&mErr, errors.New(\"secret name cannot be empty\"))\n\t}\n\n\tif !validSecretName.MatchString(s.Name) {\n\t\t_ = multierror.Append(&mErr, fmt.Errorf(\"secret name must match regex %s\", validSecretName))\n\t}\n\n\tif s.Provider == \"\" {\n\t\t_ = multierror.Append(&mErr, errors.New(\"secret provider cannot be empty\"))\n\t}\n\n\tif s.Path == \"\" {\n\t\t_ = multierror.Append(&mErr, errors.New(\"secret path cannot be empty\"))\n\t}\n\n\tif s.Provider == \"nomad\" || s.Provider == \"vault\" {\n\t\tif len(s.Env) > 0 {\n\t\t\t_ = multierror.Append(&mErr, fmt.Errorf(\"%s provider cannot use the env block\", s.Provider))\n\t\t}\n\t} else {\n\t\tif len(s.Config) > 0 {\n\t\t\t_ = multierror.Append(&mErr, fmt.Errorf(\"custom plugin provider %s cannot use the config block\", s.Provider))\n\t\t}\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\nfunc (s *Secret) Canonicalize() {\n\tif s == nil {\n\t\treturn\n\t}\n\n\tif len(s.Config) == 0 {\n\t\ts.Config = nil\n\t}","sourceCodeStart":10630,"sourceCodeEnd":10666,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L10630-L10666","documentation":"Secret block validation error: the built-in \"nomad\" or \"vault\" provider is used together with an env block. Built-in providers deliver secrets via templates, not the env mapping reserved for custom plugins.","triggerScenarios":"Thrown at nomad/structs/structs.go:10648 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the env block when using the nomad or vault provider","Use a custom plugin provider if env-based secret injection is required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}