hashicorp/terraform · error

reading Client Secret from file %q: %v

Error message

reading Client Secret from file %q: %v

What it means

getClientSecret (helpers.go:120) reads the service-principal secret from the file named by `client_secret_file_path`. If os.ReadFile fails, the OS error is wrapped into this message.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:120

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_CLIENT_ID") != "" {
		aksClientId := os.Getenv("AZURE_CLIENT_ID")
		if clientId != "" && clientId != aksClientId {
			return nil, fmt.Errorf("mismatch between supplied Client ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity")
		}
		clientId = aksClientId
	}

	return &clientId, nil
}

func getClientSecret(d *backendbase.SDKLikeData) (*string, error) {
	clientSecret := strings.TrimSpace(d.String("client_secret"))

	if path := d.String("client_secret_file_path"); path != "" {
		fileSecretRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading Client Secret from file %q: %v", path, err)
		}

		fileSecret := strings.TrimSpace(string(fileSecretRaw))

		if clientSecret != "" && clientSecret != fileSecret {
			return nil, fmt.Errorf("mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match")
		}

		clientSecret = fileSecret
	}

	return &clientSecret, nil
}

func getTenantId(d *backendbase.SDKLikeData) (*string, error) {
	tenantId := strings.TrimSpace(d.String("tenant_id"))

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_TENANT_ID") != "" {

View on GitHub (pinned to c9def3e214)

Solutions

1. Verify the path is readable: `test -r "$client_secret_file_path"`.
2. Ensure the process has permission to read the secret file.
3. Correct the mount path / typo.
4. Use client_secret directly if the value is already available in the environment.

Example fix

# before
backend "azurerm" {
  client_secret_file_path = "/etc/azure/secret"
}
# after
backend "azurerm" {
  client_secret_file_path = "/etc/azure/client-secret"
}

# ensure client_secret_file_path is readable
f="${TF_VAR_client_secret_file_path:-}"
[ -z "$f" ] || test -r "$f" || { echo "client secret file not readable: $f" >&2; exit 1; }

When it happens

Trigger: Configuring the azurerm backend with client_secret_file_path pointing at a path that does not exist, is unreadable, or is a directory.

Common situations: Kubernetes secret mount path that changed; CI env var not interpolated; file removed after a secret rotation; permission/uid mismatch on the secret file.

Related errors

• reading OIDC Token from file %q: %v
• reading Client ID from file %q: %v
• mismatch between supplied Client Secret and supplied Client
• mismatch between supplied OIDC token and supplied OIDC token
• mismatch between supplied Client ID and supplied Client ID f

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/4d3d0257216bf44e. Report an issue: GitHub.