What causes "can't form absolute path of %s: %v" in hashicorp/terraform?

Use an absolute path for certificate files to avoid dependency on filepath.Abs resolution.

can't form absolute path of %s: %v

Error message

can't form absolute path of %s: %v

What it means

Returned by getCertificateFileBytes() when filepath.Abs() fails to convert the certificate file path to an absolute path. filepath.Abs combines the input with the current working directory; it can fail if the working directory cannot be determined (same root cause as os.Getwd() failures).

Source

Thrown at internal/backend/remote-state/oci/auth.go:333

func buildHttpClient() (httpClient *http.Client) {
	httpClient = &http.Client{
		Timeout: getDurationFromEnvVar(HTTPRequestTimeOut, DefaultRequestTimeout),
		Transport: &http.Transport{
			DialContext: (&net.Dialer{
				Timeout: getDurationFromEnvVar(DialContextConnectionTimeout, DefaultConnectionTimeout),
			}).DialContext,
			TLSHandshakeTimeout: getDurationFromEnvVar(TLSHandshakeTimeout, DefaultTLSHandshakeTimeout),
			TLSClientConfig:     &tls.Config{MinVersion: tls.VersionTLS12},
			Proxy:               http.ProxyFromEnvironment,
		},
	}
	return
}

func getCertificateFileBytes(certificateFileFullPath string) (pemRaw []byte, err error) {
	absFile, err := filepath.Abs(certificateFileFullPath)
	if err != nil {
		return nil, fmt.Errorf("can't form absolute path of %s: %v", certificateFileFullPath, err)
	}

	if pemRaw, err = os.ReadFile(absFile); err != nil {
		return nil, fmt.Errorf("can't read %s: %v", certificateFileFullPath, err)
	}
	return
}
func UserAgentFromEnv() string {

	userAgentFromEnv := getEnvSettingWithBlankDefault(UserAgentSDKNameEnv)
	if userAgentFromEnv == "" {
		userAgentFromEnv = getEnvSettingWithBlankDefault(UserAgentTerraformNameEnv)
	}
	if userAgentFromEnv == "" {
		userAgentFromEnv = DefaultUserAgentBackendName
	}

	return userAgentFromEnv

View on GitHub (pinned to d32a084675)

Solutions

Use an absolute path for certificate files to avoid dependency on filepath.Abs resolution.
Ensure the terraform process runs from a valid, accessible directory.
Check container/process cwd configuration.
Set test_certificates_location to an absolute path.

Example fix

// before
export test_certificates_location=./certs
// relative path triggers filepath.Abs which can fail

// after
export test_certificates_location=/home/user/certs
terraform init

Defensive patterns

Strategy: validation

Validate before calling

func validateWorkingDirAccessible() error {
    wd, err := os.Getwd()
    if err != nil {
        return fmt.Errorf("cannot determine working directory: %w", err)
    }
    if _, err := os.Stat(wd); err != nil {
        return fmt.Errorf("working directory '%s' is not accessible: %w", wd, err)
    }
    return nil
}

Try / catch

// Pre-check before terraform init:
if err := validateWorkingDirAccessible(); err != nil {
    log.Printf("working dir issue: %v — switching to workspace dir", err)
    os.Chdir(workspaceDir)
}

Prevention

Use absolute paths for certificate files to avoid filepath.Abs dependency.
Run terraform from a stable directory.
In CI, explicitly set the working directory.

When it happens

Trigger: Any certificate file read for InstancePrincipalWithCerts (ip_cert.pem, ip_key.pem, intermediate.pem, leaf_passphrase) where filepath.Abs cannot resolve the path to absolute — typically because the process's working directory is inaccessible or deleted.

Common situations: Process's working directory was removed; running in a container with an invalid cwd; restricted environment; this is a rare OS-level failure, not a typical configuration mistake.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/00d3aad9669e1c16. Report an issue: GitHub.