{"record":{"id":"f505eaa8b7f91969","repo":"hashicorp/nomad","slug":"file-parameter-must-be-true-in-order-to-specify-fi","errorCode":null,"errorMessage":"file parameter must be true in order to specify filepath","messagePattern":"file parameter must be true in order to specify filepath","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":494,"sourceCode":"\tcase WIChangeModeSignal:\n\t\tif wi.ChangeSignal == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"change_signal must be specified when using change_mode=%q\", WIChangeModeSignal))\n\t\t}\n\tdefault:\n\t\t// Unknown change_mode\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid change_mode: %s\", wi.ChangeMode))\n\t}\n\n\tif wi.TTL > 0 && (wi.Name == \"\" || wi.Name == WorkloadIdentityDefaultName) {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl for default identity not yet supported\"))\n\t}\n\n\tif wi.TTL < 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl must be >= 0\"))\n\t}\n\n\tif wi.Filepath != \"\" && !wi.File {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"file parameter must be true in order to specify filepath\"))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\nfunc (wi *WorkloadIdentity) Warnings() error {\n\tif wi == nil {\n\t\treturn fmt.Errorf(\"must not be nil\")\n\t}\n\n\tvar mErr multierror.Error\n\n\tif n := len(wi.Audience); n == 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"identities without an audience are insecure\"))\n\t} else if n > 1 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"while multiple audiences is allowed, it is more secure to use 1 audience per identity\"))\n\t}\n","sourceCodeStart":476,"sourceCodeEnd":512,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L476-L512","documentation":"WorkloadIdentity.Validate rejects a Filepath set while File is false. Writing the identity to a custom file path only makes sense when file-based delivery is enabled; enabling filepath without file=true is treated as a misconfiguration.","triggerScenarios":"An identity block with filepath = \"/secrets/token\" but file not set to true (file = false or omitted), or structs.WorkloadIdentity{Filepath: \"...\", File: false} passed to Validate().","commonSituations":"Hand-writing HCL and setting filepath while forgetting file = true; assuming filepath implies file delivery; copying partial identity config where the file flag was stripped.","solutions":["Add file = true to the identity block when specifying filepath.","Remove the filepath field if file-based delivery is not wanted.","Ensure job templating/SDK code sets File=true whenever Filepath is non-empty."],"exampleFix":"// before\nidentity {\n  name = \"aws\"\n  filepath = \"/secrets/aws/token\"\n}\n// after\nidentity {\n  name = \"aws\"\n  file = true\n  filepath = \"/secrets/aws/token\"\n}","handlingStrategy":"validation","validationCode":"func validateFilepath(wi *structs.WorkloadIdentity) error {\n  if wi.Filepath != \"\" && !wi.File {\n    return fmt.Errorf(\"filepath %q requires file = true\", wi.Filepath)\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["In HCL templates, emit file = true whenever filepath is rendered.","Treat Filepath and File as a single coupled option in helper code.","Lint identity blocks for orphaned filepath fields."],"tags":["nomad","workload-identity","validation","config"],"backgroundTag":"missing-required-argument","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}