hashicorp/terraform · error

mismatch between supplied Client Secret and supplied Client

Error message

mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match

What it means

getClientSecret (helpers.go:126) rejects the configuration when both `client_secret` and `client_secret_file_path` are supplied with differing values after trimming. The backend will not guess which secret to use.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:126

	}

	return &clientId, nil
}

func getClientSecret(d *backendbase.SDKLikeData) (*string, error) {
	clientSecret := strings.TrimSpace(d.String("client_secret"))

	if path := d.String("client_secret_file_path"); path != "" {
		fileSecretRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client Secret from file %q: %v", path, err)
		}

		fileSecret := strings.TrimSpace(string(fileSecretRaw))

		if clientSecret != "" && clientSecret != fileSecret {
			return nil, fmt.Errorf("mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match")
		}

		clientSecret = fileSecret
	}

	return &clientSecret, nil
}

func getTenantId(d *backendbase.SDKLikeData) (*string, error) {
	tenantId := strings.TrimSpace(d.String("tenant_id"))

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_TENANT_ID") != "" {
		aksTenantId := os.Getenv("AZURE_TENANT_ID")
		if tenantId != "" && tenantId != aksTenantId {
			return nil, fmt.Errorf("mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity")
		}
		tenantId = aksTenantId
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Provide only one of client_secret or client_secret_file_path.
2. If both must remain, make the inline value byte-identical (after trimming) to the file contents.
3. Rotate and re-export the secret into a single source.

Example fix

# before
backend "azurerm" {
  client_secret           = "OLD-SECRET"
  client_secret_file_path = "/etc/azure/client-secret"  # NEW-SECRET
}
# after
backend "azurerm" {
  client_secret_file_path = "/etc/azure/client-secret"
}

# ensure client_secret and client_secret_file_path agree, or only one is set
sec="${TF_VAR_client_secret:-}"
file="${TF_VAR_client_secret_file_path:-}"
if [ -n "$sec" ] && [ -n "$file" ]; then
  fs="$(tr -d '[:space:]' < "$file")"
  [ "$sec" = "$fs" ] || { echo "client secret / file mismatch" >&2; exit 1; }
fi

When it happens

Trigger: Setting client_secret inline and client_secret_file_path simultaneously in the backend block (or env) with non-identical values.

Common situations: Secret rotation updated only one source; a stale inline secret left in version control; env var drift between environments.

Related errors

• reading Client Secret from file %q: %v
• reading OIDC Token from file %q: %v
• mismatch between supplied OIDC token and supplied OIDC token
• reading Client ID from file %q: %v
• mismatch between supplied Client ID and supplied Client ID f

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/b9b086106000f726. Report an issue: GitHub.