{"record":{"id":"d9e7fd10ee9c4f78","repo":"hashicorp/terraform","slug":"failed-to-replace-s-with-temporary-file-s-s","errorCode":null,"errorMessage":"failed to replace %s with temporary file %s: %s","messagePattern":"failed to replace (.+?) with temporary file (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/credentials.go","lineNumber":426,"sourceCode":"\t\t\tif !moved {\n\t\t\t\tos.Remove(name)\n\t\t\t}\n\t\t}(f, tmpName)\n\n\t\t// Write the credentials to the temporary file, then immediately close\n\t\t// it, whether or not the write succeeds.\n\t\t_, err = f.Write(newSrc)\n\t\tf.Close()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot write to temporary file %s: %s\", tmpName, err)\n\t\t}\n\n\t\t// Temporary file now replaces the original file, as atomically as\n\t\t// possible. (At the very least, we should not end up with a file\n\t\t// containing only a partial JSON object.)\n\t\terr = replacefile.AtomicRename(tmpName, filename)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to replace %s with temporary file %s: %s\", filename, tmpName, err)\n\t\t}\n\n\t\t// Credentials file should be readable only by its owner. (This may\n\t\t// not be effective on all platforms, but should at least work on\n\t\t// Unix-like targets and should be harmless elsewhere.)\n\t\tif err := os.Chmod(filename, 0600); err != nil {\n\t\t\treturn fmt.Errorf(\"cannot set mode for credentials file %s: %s\", filename, err)\n\t\t}\n\n\t\tmoved = true\n\t}\n\n\tif new != nil {\n\t\ts.configured[host] = new.ToStore()\n\t} else {\n\t\tdelete(s.configured, host)\n\t}\n","sourceCodeStart":408,"sourceCodeEnd":444,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/command/cliconfig/credentials.go#L408-L444","documentation":"Thrown when replacefile.AtomicRename fails to atomically move the freshly-written temp file over the real credentials file. AtomicRename performs an OS-level rename (rename(2) on Unix, MoveFileEx with MOVEFILE_REPLACE_EXISTING on Windows); failure means the rename syscall itself failed, not the write.","triggerScenarios":"Source and destination are on different filesystems (EXDEV on POSIX — should not happen since temp is created in the same dir, but can if the dir spans a bind mount); destination is a directory or the parent lacks write permission; on Windows the destination is open in another process; SELinux/AppArmor denies the rename.","commonSituations":"Another Terraform process or editor holds the file open (Windows); a security module blocks cross-context rename; the credentials path was redirected across a mount boundary by a symlink; the parent directory is not writable.","solutions":["Close any editor or other Terraform process holding the credentials file open, then retry.","Ensure the parent directory of the credentials file is writable and on the same filesystem as the temp file (no cross-mount symlink).","Check SELinux/AppArmor audit logs for denials (`ausearch -m avc` / `dmesg | grep -i denied`).","On persistent EXDEV, remove symlinks in the credentials path so temp and target share one filesystem."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Same-filesystem check to pre-empt EXDEV-style rename failures\nfunc sameFS(a, b string) bool {\n    var sa, sb syscall.Stat_t\n    if syscall.Stat(a, &sa) != nil { return false }\n    if syscall.Stat(b, &sb) != nil { return false }\n    return sa.Dev == sb.Dev\n}","preventionTips":["Keep the credentials temp file and target on the same filesystem (the code already does this if dir is consistent).","Close the credentials file in other processes before login/logout on Windows.","Inspect SELinux/AppArmor audit logs when renames fail mysteriously."],"tags":["credentials","filesystem","rename","atomic-write","locking"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}