hashicorp/terraform · error

invalid credentials location %#v

Error message

invalid credentials location %#v

What it means

An internal assertion error in the default case of a switch over credentials location types (CredentialsLocation) in updateHostCredentials. The source comment states the above cases (CredentialsInOtherFile, CredentialsInPrimaryFile/CredentialsNotAvailable, CredentialsViaHelper) are exhaustive, so reaching this default is a Terraform bug indicating an unexpected enum value.

Source

Thrown at internal/command/cliconfig/credentials.go:317

	switch loc := s.HostCredentialsLocation(host); loc {
	case CredentialsInOtherFile:
		return ErrUnwritableHostCredentials(host)
	case CredentialsInPrimaryFile, CredentialsNotAvailable:
		// If the host already has credentials stored locally then we'll update
		// them locally too, even if there's a credentials helper configured,
		// because the user might be intentionally retaining this particular
		// host locally for some reason, e.g. if the credentials helper is
		// talking to some shared remote service like HashiCorp Vault.
		return s.updateLocalHostCredentials(host, new)
	case CredentialsViaHelper:
		// Delegate entirely to the helper, then.
		if new == nil {
			return s.helper.ForgetForHost(host)
		}
		return s.helper.StoreForHost(host, new)
	default:
		// Should never happen because the above cases are exhaustive
		return fmt.Errorf("invalid credentials location %#v", loc)
	}
}

func (s *CredentialsSource) updateLocalHostCredentials(host svchost.Hostname, new svcauth.HostCredentialsWritable) error {
	// This function updates the local credentials file in particular,
	// regardless of whether a credentials helper is active. It should be
	// called only indirectly via updateHostCredentials.

	filename, err := s.CredentialsFilePath()
	if err != nil {
		return fmt.Errorf("unable to determine credentials file path: %s", err)
	}

	oldSrc, err := ioutil.ReadFile(filename)
	if err != nil && !os.IsNotExist(err) {
		return fmt.Errorf("cannot read %s: %s", filename, err)
	}

View on GitHub (pinned to d32a084675)

Solutions

1. Report a bug to the Terraform project at github.com/hashicorp/terraform/issues with the full error and version
2. Downgrade to a stable version if this appeared after an upgrade
3. If developing Terraform: add the missing case to the switch in internal/command/cliconfig/credentials.go

// This is an internal bug; surface it clearly in automation
if strings.Contains(stderr, "invalid credentials location") {
    return fmt.Errorf("internal Terraform bug: please report at github.com/hashicorp/terraform/issues")
}

When it happens

Trigger: updateHostCredentials switches on s.HostCredentialsLocation(host) and the default case is reached, meaning a CredentialsLocation value outside the known set (0='P', 'O', 'H') was returned. This would only happen if a new CredentialsLocation variant was added without updating this switch.

Common situations: Should never happen in production. If seen, it indicates a code regression where a new CredentialsLocation constant was introduced without updating the exhaustive switch in updateHostCredentials.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• unsupported variable option name %q (this is a bug in Terraf
• unable to determine credentials file path: %s
• No state data received from Terraform: No state data was rec
• unsupported operation type: %s This is a bug in Terraform a
• PlanOutPath set without also setting PlanOutStateStore or Pl

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/9af22a4033db4f72. Report an issue: GitHub.