How to fix Error: Error creating local file: open: permission denied in Terraform

Write files to directories where the Terraform-running user has full write access, such as your project directory or /tmp. Avoid system directories like /etc/ or /var/:

# Wrong - system directory requires root
resource "local_file" "config" {
  content  = "app config"
  filename = "/etc/myapp/config.conf"
}

# Correct - use project directory
resource "local_file" "config" {
  content  = "app config"
  filename = "${path.module}/config/config.conf"
}

Using ${path.module} ensures the file is created relative to your Terraform module directory, which is typically user-writable.

Always set file permissions that allow Terraform to both write and read the file. Avoid write-only permissions:

resource "local_file" "example" {
  content         = "Hello world"
  filename        = "${path.module}/hello.txt"
  file_permission = "0644"  # Owner: read/write, Others: read only
}

Common safe permissions:
- 0644 - Owner reads/writes, others read (standard for config files)
- 0600 - Only owner reads/writes (for sensitive files)
- Never use 0200 (write-only) as Terraform cannot read the file on subsequent runs.

Ensure the target directory exists and has write permissions for the user running Terraform:

# Check current directory permissions
ls -ld /path/to/target/dir

# Add write permission if missing (only if you own the directory)
chmod u+w /path/to/target/dir

# For group write access (shared environments)
chmod g+w /path/to/target/dir

The directory must be writable by the Terraform user. If you don't own it, ask the owner to grant write access or use a different directory.

If a file exists with overly restrictive permissions, manually delete it before re-running Terraform:

# Remove the problematic file
rm /path/to/file

# Re-run Terraform
terraform apply

Alternatively, fix the existing file's permissions:

# Make the file readable
chmod u+r /path/to/file

After fixing, re-run terraform apply.

When using file provisioners on remote machines, the connection user may lack permissions. Use a two-step approach: copy to /tmp, then move to the protected location with sudo:

provisioner "file" {
  source      = "myfile.conf"
  destination = "/tmp/myfile.conf"
}

provisioner "remote-exec" {
  inline = [
    "sudo mv /tmp/myfile.conf /etc/myapp/myfile.conf",
    "sudo chown root:root /etc/myapp/myfile.conf",
    "sudo chmod 644 /etc/myapp/myfile.conf"
  ]
}

This works around the limitation that file provisioners cannot use sudo directly.

If running in Terraform Enterprise with non-root agents, grant the tfc-agent group write access to necessary directories:

# Allow tfc-agent group to write to root home directory
sudo chown -R :tfc-agent /root
sudo chmod -R g+rwx /root

Terraform Enterprise agents run as a non-root user for security. Ensure working directories have group write permissions for the agent's user group. Check your Terraform Enterprise documentation for the specific service user name.