What causes "can't read %s: %v" in hashicorp/terraform?

Check the wrapped %v error for the exact OS-level cause (no such file, permission denied, etc.).

can't read %s: %v

Error message

can't read %s: %v

What it means

Returned by getCertificateFileBytes() when os.ReadFile fails after the path was successfully resolved to absolute. This is the actual file read failure — the file doesn't exist at the resolved path, is not readable, or is a directory.

Source

Thrown at internal/backend/remote-state/oci/auth.go:337

			DialContext: (&net.Dialer{
				Timeout: getDurationFromEnvVar(DialContextConnectionTimeout, DefaultConnectionTimeout),
			}).DialContext,
			TLSHandshakeTimeout: getDurationFromEnvVar(TLSHandshakeTimeout, DefaultTLSHandshakeTimeout),
			TLSClientConfig:     &tls.Config{MinVersion: tls.VersionTLS12},
			Proxy:               http.ProxyFromEnvironment,
		},
	}
	return
}

func getCertificateFileBytes(certificateFileFullPath string) (pemRaw []byte, err error) {
	absFile, err := filepath.Abs(certificateFileFullPath)
	if err != nil {
		return nil, fmt.Errorf("can't form absolute path of %s: %v", certificateFileFullPath, err)
	}

	if pemRaw, err = os.ReadFile(absFile); err != nil {
		return nil, fmt.Errorf("can't read %s: %v", certificateFileFullPath, err)
	}
	return
}
func UserAgentFromEnv() string {

	userAgentFromEnv := getEnvSettingWithBlankDefault(UserAgentSDKNameEnv)
	if userAgentFromEnv == "" {
		userAgentFromEnv = getEnvSettingWithBlankDefault(UserAgentTerraformNameEnv)
	}
	if userAgentFromEnv == "" {
		userAgentFromEnv = DefaultUserAgentBackendName
	}

	return userAgentFromEnv
}

// OboTokenProvider interface that wraps information about auth tokens so the sdk client can make calls
// on behalf of a different authorized user

View on GitHub (pinned to d32a084675)

Solutions

Check the wrapped %v error for the exact OS-level cause (no such file, permission denied, etc.).
Verify the file exists at the resolved absolute path: ls -la /full/resolved/path/ip_cert.pem.
Set test_certificates_location to the correct directory.
Fix file permissions if needed (chmod 644 or 600).

Example fix

// before
export test_certificates_location=/wrong/path
terraform init
// Error: can't read /wrong/path/ip_cert.pem: ...

// after
export test_certificates_location=/home/user/test-certs
ls /home/user/test-certs/ip_cert.pem  # verify
terraform init

Defensive patterns

Strategy: validation

Validate before calling

func validateCertFilesReadable(certsDir string, files []string) error {
    for _, f := range files {
        p := filepath.Join(certsDir, f)
        abs, _ := filepath.Abs(p)
        if _, err := os.ReadFile(abs); err != nil {
            return fmt.Errorf("cannot read %s: %w", abs, err)
        }
    }
    return nil
}

Try / catch

// Pre-validate all cert files:
requiredCerts := []string{"ip_cert.pem", "ip_key.pem", "intermediate.pem"}
if err := validateCertFilesReadable(certsDir, requiredCerts); err != nil {
    log.Fatal(err)
}

Prevention

Pre-validate that all certificate files exist and are readable before terraform init.
Use absolute paths for test_certificates_location.
Check file permissions as part of CI pre-flight checks.

When it happens

Trigger: Any certificate file read for InstancePrincipalWithCerts where the file doesn't exist at the resolved absolute path, has restrictive permissions, or is otherwise unreadable.

Common situations: test_certificates_location points to wrong directory; certificate file was deleted or renamed; file permission is too restrictive; typo in the filename; this error wraps the underlying os.ReadFile error with %v for details.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/1fe15017b7a2d439. Report an issue: GitHub.