What causes "cannot set mode for credentials file %s: %s" in hashicorp/terraform?

Move the credentials file to a POSIX-compliant local filesystem and update TF_CLI_CONFIG_FILE / HOME accordingly.

cannot set mode for credentials file %s: %s

Error message

cannot set mode for credentials file %s: %s

What it means

Thrown after the atomic rename succeeded but os.Chmod(filename, 0600) failed. Terraform enforces owner-only permissions on the credentials file (it contains tokens). The data is already correctly written and in place; this error means only the permission tightening failed — common on filesystems that do not support the requested mode.

Source

Thrown at internal/command/cliconfig/credentials.go:433

		_, err = f.Write(newSrc)
		f.Close()
		if err != nil {
			return fmt.Errorf("cannot write to temporary file %s: %s", tmpName, err)
		}

		// Temporary file now replaces the original file, as atomically as
		// possible. (At the very least, we should not end up with a file
		// containing only a partial JSON object.)
		err = replacefile.AtomicRename(tmpName, filename)
		if err != nil {
			return fmt.Errorf("failed to replace %s with temporary file %s: %s", filename, tmpName, err)
		}

		// Credentials file should be readable only by its owner. (This may
		// not be effective on all platforms, but should at least work on
		// Unix-like targets and should be harmless elsewhere.)
		if err := os.Chmod(filename, 0600); err != nil {
			return fmt.Errorf("cannot set mode for credentials file %s: %s", filename, err)
		}

		moved = true
	}

	if new != nil {
		s.configured[host] = new.ToStore()
	} else {
		delete(s.configured, host)
	}

	return nil
}

// ReadHostsInCredentialsFile discovers which hosts have credentials configured
// in the credentials file specifically, as opposed to in any other CLI
// config file.
//

View on GitHub (pinned to d32a084675)

Solutions

Move the credentials file to a POSIX-compliant local filesystem and update TF_CLI_CONFIG_FILE / HOME accordingly.
If on Windows/WSL, use a path under the native Linux filesystem (e.g. /home/$USER) rather than /mnt/c.
If the file is owned by another user, fix ownership: `sudo chown $USER <file>` then retry.
If you must use a non-POSIX mount, accept that Terraform cannot enforce 0600 there and relocate the file.

Example fix

// before: TF_CLI_CONFIG_FILE points at /mnt/c/.../credentials.tfrc.json (NTFS)
// $ export TF_CLI_CONFIG_FILE=$HOME/.terraform.d/credentials.tfrc.json
// after: chmod 0600 succeeds on the ext4 home volume

Defensive patterns

Strategy: validation

Validate before calling

func chmodSupported(path string) bool {
    var s syscall.Statfs_t
    if syscall.Statfs(path, &s) != nil { return true } // assume yes if unknown
    switch s.Type {
    case 0x4d44, 0x65735546: // MSDOS, exFAT — non-exhaustive
        return false
    }
    return true
}

Prevention

Store the credentials file on a POSIX filesystem (ext4, apfs, xfs).
Avoid FAT/exFAT and permissive CIFS mounts for credentials.
On WSL, use the native Linux home, not /mnt/c.

When it happens

Trigger: Credentials file lives on a filesystem that does not honor Unix permission bits (FAT/exFAT, some CIFS shares); the file was replaced but is now owned by a different uid so the caller cannot chmod it; a Windows environment where 0600 has no meaning.

Common situations: TF_CLI_CONFIG_FILE on a USB stick or FAT-formatted partition; CIFS mount with `noperm`/`mode=0777`; running as one user but the file was chown'd to another; WSL accessing a Windows filesystem.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/0cf962524d71a1ca. Report an issue: GitHub.