What causes "can not get working directory for current os platform" in hashicorp/terraform?

Run terraform from a directory that exists and is accessible: cd to a valid directory and retry.

can not get working directory for current os platform

Error message

can not get working directory for current os platform

What it means

Returned when os.Getwd() fails during InstancePrincipalWithCerts setup. The working directory is used as the default location for test certificate files. This is an OS-level failure: the current directory was deleted, permissions changed, or the process is in an unusual state.

Source

Thrown at internal/backend/remote-state/oci/auth.go:197

		}

		cfg, err := auth.InstancePrincipalConfigurationForRegionWithCustomClient(common.StringToRegion(p.region), instancePrincipalAuthClientModifier)
		if err != nil {
			return nil, err
		}
		logger.Debug(" Configuration provided by: %s", cfg)

		configProviders = append(configProviders, cfg)
	case strings.ToLower(AuthInstancePrincipalWithCertsSetting):
		logger.Info("Attempting to authenticate using instance principal with certificates")

		if p.region == "" {
			return nil, fmt.Errorf("unable to determine region from Terraform backend configuration while using Instance Principal with certificates")
		}

		defaultCertsDir, err := os.Getwd()
		if err != nil {
			return nil, fmt.Errorf("can not get working directory for current os platform")
		}

		certsDir := filepath.Clean(getEnvSettingWithDefault("test_certificates_location", defaultCertsDir))
		leafCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "ip_cert.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read leaf certificate from %s", filepath.Join(certsDir, "ip_cert.pem"))
		}

		leafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, "ip_key.pem"))
		if err != nil {
			return nil, fmt.Errorf("can not read leaf private key from %s", filepath.Join(certsDir, "ip_key.pem"))
		}

		leafPassphraseBytes := []byte{}
		if _, err := os.Stat(certsDir + "/leaf_passphrase"); !os.IsNotExist(err) {
			leafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + "leaf_passphrase"))
			if err != nil {
				return nil, fmt.Errorf("can not read leafPassphraseBytes from %s", filepath.Join(certsDir+"leaf_passphrase"))

View on GitHub (pinned to d32a084675)

Solutions

Run terraform from a directory that exists and is accessible: cd to a valid directory and retry.
Set the 'test_certificates_location' env var to an explicit absolute path so os.Getwd() is only used as a fallback default (though Getwd is called before the fallback applies).
Check container/process working directory configuration if running in CI or containers.
If the issue persists, consider switching to auth="InstancePrincipal" which does not need the working directory.

Example fix

// before
// running terraform from a directory that was deleted or unmounted

// after
// ensure cwd exists:
cd /valid/existing/directory && terraform init

Defensive patterns

Strategy: try-catch

Validate before calling

// Before running terraform, verify the working directory is accessible:
func validateWorkingDir() error {
    wd, err := os.Getwd()
    if err != nil {
        return fmt.Errorf("working directory inaccessible: %w", err)
    }
    if _, err := os.Stat(wd); err != nil {
        return fmt.Errorf("working directory does not exist: %w", err)
    }
    return nil
}

Try / catch

// In your orchestration script:
if err := validateWorkingDir(); err != nil {
    log.Printf("warning: %v, switching to a known-good directory", err)
    if err := os.Chdir("/tmp/terraform-work"); err != nil {
        log.Fatal(err)
    }
}

Prevention

Run terraform from a stable, well-known directory.
In CI, explicitly cd to the workspace before running terraform.
Avoid running terraform from ephemeral or temp directories that may be cleaned up.

When it happens

Trigger: os.Getwd() returns a non-nil error, which can happen if the current working directory has been removed while the process is running, or on certain restricted/containerized environments where the cwd is not accessible.

Common situations: Process's working directory was deleted or renamed by another process; running in a container where the cwd mount was removed; restricted sandbox environments; this is rare and indicates an environment issue rather than a config mistake.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/1ee4f973c4255887. Report an issue: GitHub.