{"record":{"id":"86c0e4560c0bfee5","repo":"hashicorp/terraform","slug":"no-more-than-one-credentials-helper-block-may-be-s","errorCode":null,"errorMessage":"No more than one credentials_helper block may be specified","messagePattern":"No more than one credentials_helper block may be specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/cliconfig.go","lineNumber":316,"sourceCode":"\t\t\t\tfmt.Errorf(\"The host %q block has an invalid hostname: %s\", givenHost, err),\n\t\t\t)\n\t\t}\n\t}\n\n\t// Check that all \"credentials\" blocks have valid hostnames.\n\tfor givenHost := range c.Credentials {\n\t\t_, err := svchost.ForComparison(givenHost)\n\t\tif err != nil {\n\t\t\tdiags = diags.Append(\n\t\t\t\tfmt.Errorf(\"The credentials %q block has an invalid hostname: %s\", givenHost, err),\n\t\t\t)\n\t\t}\n\t}\n\n\t// Should have zero or one \"credentials_helper\" blocks\n\tif len(c.CredentialsHelpers) > 1 {\n\t\tdiags = diags.Append(\n\t\t\tfmt.Errorf(\"No more than one credentials_helper block may be specified\"),\n\t\t)\n\t}\n\n\t// Should have zero or one \"provider_installation\" blocks\n\tif len(c.ProviderInstallation) > 1 {\n\t\tdiags = diags.Append(\n\t\t\tfmt.Errorf(\"No more than one provider_installation block may be specified\"),\n\t\t)\n\t}\n\n\tif c.PluginCacheDir != \"\" {\n\t\t_, err := os.Stat(c.PluginCacheDir)\n\t\tif err != nil {\n\t\t\tdiags = diags.Append(\n\t\t\t\tfmt.Errorf(\"The specified plugin cache dir %s cannot be opened: %s\", c.PluginCacheDir, err),\n\t\t\t)\n\t\t}\n\t}","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/cliconfig/cliconfig.go#L298-L334","documentation":"Emitted by `Config.Validate` (cliconfig.go:314-317) when more than one `credentials_helper` block is present across the merged CLI config. Terraform allows zero or one such blocks; the HCL decode produces a map keyed by helper type, so two different helper types push the map length above one.","triggerScenarios":"Defining two `credentials_helper \"<type>\" { }` blocks (with different type labels) in the same `.terraformrc`, or one in `.terraformrc` plus another in a `~/.terraform.d/*.tfrc` file that gets merged.","commonSituations":"Adding a new helper (e.g. `atlas`/`vault`) without removing the previous one; merging personal config with a team-supplied `*.tfrc` that also declares a helper.","solutions":["Keep exactly one `credentials_helper` block across all CLI config files.","Search all loaded files (main `.terraformrc` plus every `*.tfrc`/`*.tfrc.json` in the config dir) for duplicate blocks.","Remove or comment out the helper you no longer want.","Re-run `terraform init`; `Validate` re-checks on every load."],"exampleFix":"# before\ncredentials_helper \"atlas\" { args = [] }\ncredentials_helper \"vault\" { args = [\"-path=secret\"] }\n# No more than one credentials_helper block may be specified\n\n# after\ncredentials_helper \"vault\" { args = [\"-path=secret\"] }","handlingStrategy":"validation","validationCode":"// Count credentials_helper blocks across all loaded CLI config files.\nfunc countCredentialsHelpers(files []string) (int, error) {\n    n := 0\n    for _, f := range files {\n        b, err := os.ReadFile(f)\n        if err != nil {\n            continue\n        }\n        if bytes.Contains(b, []byte(\"credentials_helper\")) {\n            n++\n        }\n    }\n    return n, nil\n}\n// if n > 1 -> reject before running terraform.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep at most one `credentials_helper` block in all CLI config files combined.","Audit team-shared `*.tfrc` files before merging into personal config.","Remember Merge concatenates files, so duplicates add up across files."],"tags":["terraform","cli-config","credentials-helper","validation","duplicate"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}