hashicorp/terraform · error

reading Client ID from file %q: %v

Error message

reading Client ID from file %q: %v

What it means

getClientId (helpers.go:90) reads the Azure service-principal / app client ID from the file named by `client_id_file_path`. If os.ReadFile fails, the OS error is wrapped into this message.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:90

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity")
		}

		idToken = fileToken
	}

	return &idToken, nil
}

func getClientId(d *backendbase.SDKLikeData) (*string, error) {
	clientId := strings.TrimSpace(d.String("client_id"))

	if path := d.String("client_id_file_path"); path != "" {
		fileClientIdRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client ID from file %q: %v", path, err)
		}

		fileClientId := strings.TrimSpace(string(fileClientIdRaw))

		if clientId != "" && clientId != fileClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and supplied Client ID file contents - please either remove one or ensure they match")
		}

		clientId = fileClientId
	}

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_CLIENT_ID") != "" {
		aksClientId := os.Getenv("AZURE_CLIENT_ID")
		if clientId != "" && clientId != aksClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity")
		}
		clientId = aksClientId
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Check the path is readable: `test -r "$client_id_file_path"`.
2. Ensure the terraform process can read the mounted secret file.
3. Correct typos or an incorrect secret mount path.
4. Prefer setting client_id directly if the value is already available.

Example fix

# before
backend "azurerm" {
  client_id_file_path = "/etc/azure/client"   # missing
}
# after
backend "azurerm" {
  client_id_file_path = "/etc/azure/client-id"
}

# ensure client_id_file_path is readable
f="${TF_VAR_client_id_file_path:-}"
[ -z "$f" ] || test -r "$f" || { echo "client id file not readable: $f" >&2; exit 1; }

When it happens

Trigger: Configuring the azurerm backend with client_id_file_path set to a path that does not exist, is unreadable, or is a directory.

Common situations: Mounted-secret path that differs across environments; wrong env var interpolation in CI; the file not yet created by an init container; permission/uid mismatch.

Related errors

• reading OIDC Token from file %q: %v
• mismatch between supplied Client ID and supplied Client ID f
• reading Client Secret from file %q: %v
• mismatch between supplied OIDC token and supplied OIDC token
• mismatch between supplied Client ID and that provided by AKS

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/30473c862fdffbf8. Report an issue: GitHub.