hashicorp/terraform · error

mismatch between supplied Client ID and that provided by AKS

Error message

mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity

What it means

In the AKS-workload-identity branch of getClientId (helpers.go:105), if a client_id was already resolved and differs from the `AZURE_CLIENT_ID` env var injected by the workload-identity webhook, the backend aborts rather than silently switching identity.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:105

		fileClientIdRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client ID from file %q: %v", path, err)
		}

		fileClientId := strings.TrimSpace(string(fileClientIdRaw))

		if clientId != "" && clientId != fileClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match")
		}

		clientId = fileClientId
	}

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_CLIENT_ID") != "" {
		aksClientId := os.Getenv("AZURE_CLIENT_ID")
		if clientId != "" && clientId != aksClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity")
		}
		clientId = aksClientId
	}

	return &clientId, nil
}

func getClientSecret(d *backendbase.SDKLikeData) (*string, error) {
	clientSecret := strings.TrimSpace(d.String("client_secret"))

	if path := d.String("client_secret_file_path"); path != "" {
		fileSecretRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client Secret from file %q: %v", path, err)
		}

		fileSecret := strings.TrimSpace(string(fileSecretRaw))

View on GitHub (pinned to c9def3e214)

Solutions

1. Remove client_id / client_id_file_path when using AKS workload identity and let AZURE_CLIENT_ID be authoritative.
2. Ensure the configured client_id equals the app registration the federated credential targets.
3. Disable use_aks_workload_identity if you want the inline client_id to win.

Example fix

# before
backend "azurerm" {
  use_aks_workload_identity = true
  client_id                 = "22222222-2222-2222-2222-222222222222"
}
# after
backend "azurerm" {
  use_aks_workload_identity = true
}

# ensure no conflicting client_id when AKS workload identity is used
if [ "${TF_VAR_use_aks_workload_identity:-false}" = "true" ] && [ -n "${AZURE_CLIENT_ID:-}" ]; then
  [ -z "${TF_VAR_client_id:-}" ] || [ "$TF_VAR_client_id" = "$AZURE_CLIENT_ID" ] \
    || { echo "client_id conflicts with AZURE_CLIENT_ID" >&2; exit 1; }
fi

When it happens

Trigger: use_aks_workload_identity=true, AZURE_CLIENT_ID is set, and an inline client_id / client_id_file_path value that does not match is also configured.

Common situations: Left-over client_id from a previous non-AKS setup; pointing at a different app registration than the federated credential is bound to; mismatched annotation and backend config.

Related errors

• mismatch between supplied OIDC token and OIDC token file con
• mismatch between supplied Tenant ID and that provided by AKS
• reading OIDC Token from file %q provided by AKS Workload Ide
• reading Client ID from file %q: %v
• mismatch between supplied Client ID and supplied Client ID f

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/2a97b8baa1c48e54. Report an issue: GitHub.