hashicorp/terraform · error

unable to determine credentials file path: %s

Error message

unable to determine credentials file path: %s

What it means

Emitted by `updateLocalHostCredentials` (credentials.go:328) when `s.CredentialsFilePath()` returns an error while trying to store/forget credentials. In the current implementation `CredentialsFilePath` simply returns the stored `credentialsFilePath` with a nil error, so this is a defensive guard for future changes; today it is effectively unreachable unless the field was unset/invalid.

Source

Thrown at internal/command/cliconfig/credentials.go:328

		// Delegate entirely to the helper, then.
		if new == nil {
			return s.helper.ForgetForHost(host)
		}
		return s.helper.StoreForHost(host, new)
	default:
		// Should never happen because the above cases are exhaustive
		return fmt.Errorf("invalid credentials location %#v", loc)
	}
}

func (s *CredentialsSource) updateLocalHostCredentials(host svchost.Hostname, new svcauth.HostCredentialsWritable) error {
	// This function updates the local credentials file in particular,
	// regardless of whether a credentials helper is active. It should be
	// called only indirectly via updateHostCredentials.

	filename, err := s.CredentialsFilePath()
	if err != nil {
		return fmt.Errorf("unable to determine credentials file path: %s", err)
	}

	oldSrc, err := ioutil.ReadFile(filename)
	if err != nil && !os.IsNotExist(err) {
		return fmt.Errorf("cannot read %s: %s", filename, err)
	}

	var raw map[string]interface{}

	if len(oldSrc) > 0 {
		// When decoding we use a custom decoder so we can decode any numbers as
		// json.Number and thus avoid losing any accuracy in our round-trip.
		dec := json.NewDecoder(bytes.NewReader(oldSrc))
		dec.UseNumber()
		err = dec.Decode(&raw)
		if err != nil {
			return fmt.Errorf("cannot read %s: %s", filename, err)
		}

View on GitHub (pinned to c9def3e214)

Solutions

1. Ensure Terraform is invoked with a resolvable home/config dir so `CredentialsConfigFile()` succeeds (see error 554).
2. If embedding Terraform internals, always build the source via `Config.CredentialsSource` rather than constructing it directly.
3. Re-run `terraform login` after fixing `HOME`/`TF_CLI_CONFIG_FILE`.

// Defensive: ensure CredentialsFilePath resolves before store/forget.
if _, err := src.CredentialsFilePath(); err != nil {
    return fmt.Errorf("cannot proceed with credential update: %w", err)
}

// if err := src.StoreForHost(host, creds); err != nil {
//     if strings.Contains(err.Error(), "unable to determine credentials file path") {
//         // rebuild the CredentialsSource via Config.CredentialsSource
//     }
// }

When it happens

Trigger: Calling `StoreForHost`/`ForgetForHost` (e.g. via `terraform login`/`terraform logout`) on a `CredentialsSource` whose internal `credentialsFilePath` could not be resolved. Reachable only if `CredentialsFilePath()` is extended to fail or the source was constructed without a path.

Common situations: Constructing a `CredentialsSource` via an unconventional path that leaves `credentialsFilePath` empty; test harnesses that bypass `CredentialsConfigFile()`. End users essentially never see this.

Related errors

• The credentials %q block has an invalid hostname: %s
• can't locate credentials file: %s
• cannot serialize updated credentials file: %s
• source and content cannot both be null
• at most 1 action can be invoked per operation

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/0b74b3710531bcb3. Report an issue: GitHub.