apache/druid · critical · ISE

Set 'account' to the storage account that needs to be config

Error message

Set 'account' to the storage account that needs to be configured in the azure config. Please refer to azure documentation.

What it means

At Guice provider getAzureClientFactory time, the AzureAccountConfig must specify a storage account. If druid.azure.account is empty the module throws IllegalStateException immediately, preventing the Azure extension from initializing with incomplete auth configuration.

Source

Thrown at extensions-core/azure-extensions/src/main/java/org/apache/druid/storage/azure/AzureStorageDruidModule.java:118

    JsonConfigProvider.bind(binder, "druid.indexer.logs", AzureTaskLogsConfig.class);
    binder.bind(AzureTaskLogs.class).in(LazySingleton.class);
    binder.install(new FactoryModuleBuilder()
                       .build(AzureByteSourceFactory.class));
    binder.install(new FactoryModuleBuilder()
                       .build(AzureEntityFactory.class));
    binder.install(new FactoryModuleBuilder()
                       .build(AzureCloudBlobIteratorFactory.class));
    binder.install(new FactoryModuleBuilder()
                       .build(AzureCloudBlobIterableFactory.class));
  }


  @Provides
  @LazySingleton
  public AzureClientFactory getAzureClientFactory(final AzureAccountConfig config)
  {
    if (StringUtils.isEmpty(config.getAccount())) {
      throw new ISE("Set 'account' to the storage account that needs to be configured in the azure config."
          + " Please refer to azure documentation.");
    }

    if (StringUtils.isEmpty(config.getKey()) && StringUtils.isEmpty(config.getSharedAccessStorageToken()) && BooleanUtils.isNotTrue(config.getUseAzureCredentialsChain())) {
      throw new ISE("Either set 'key' or 'sharedAccessStorageToken' or 'useAzureCredentialsChain' in the azure config."
          + " Please refer to azure documentation.");
    }

    /* Azure named keys and sas tokens are mutually exclusive with each other and with azure keychain auth,
    but any form of auth supported by the DefaultAzureCredentialChain is not mutually exclusive, e.g. you can have
    environment credentials or workload credentials or managed credentials using the same chain.
    **/
    if (!StringUtils.isEmpty(config.getKey()) && !StringUtils.isEmpty(config.getSharedAccessStorageToken()) ||
        !StringUtils.isEmpty(config.getKey()) && BooleanUtils.isTrue(config.getUseAzureCredentialsChain()) ||
        !StringUtils.isEmpty(config.getSharedAccessStorageToken()) && BooleanUtils.isTrue(config.getUseAzureCredentialsChain())
    ) {
      throw new ISE("Set only one of 'key' or 'sharedAccessStorageToken' or 'useAzureCredentialsChain' in the azure config."
          + " Please refer to azure documentation.");

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Set druid.azure.account to your storage account name in runtime.properties
2. Ensure the azure extension is intentionally enabled and its druid.azure.* config present on all relevant nodes
3. Check for typos/whitespace in the account value

Example fix

// before
# runtime.properties (azure storage type but no account)
druid.storage.type=azure
// after
druid.storage.type=azure
druid.azure.account=mystorageaccount

String account = config.get("druid.azure.account");
if (account == null || account.isBlank()) throw new IllegalStateException("druid.azure.account must be set when using Azure deep storage");

try { injector.getInstance(AzureClientFactory.class); } catch (ProvisionException e) { /* surface the ISE about druid.azure.account at deploy time */ }

When it happens

Trigger: Starting a Druid node with the Azure extension loaded but druid.azure.account not set (empty/missing) in the runtime properties; AzureStorageDruidModule.getAzureClientFactory validates it when the factory is provisioned.

Common situations: Copying runtime.properties from a non-Azure setup; typo in the property name; account key removed during config cleanup while the azure storage type is still enabled.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Either set 'key' or 'sharedAccessStorageToken' or 'useAzureC
• Cannot delete all segment files since Azure Deep Storage sin
• Set only one of 'key' or 'sharedAccessStorageToken' or 'useA
• Cannot delete all segment from S3 Deep Storage since druid.s
• The gRPC query server requires either a Basic or Anonymous a

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/3347973556693976. Report an issue: GitHub.