{"record":{"id":"25d09300dc159c03","repo":"hashicorp/terraform","slug":"resource-group-name-is-required-when-lookup-blo","errorCode":null,"errorMessage":"`resource_group_name` is required when `lookup_blob_endpoint` is set","messagePattern":"`resource_group_name` is required when `lookup_blob_endpoint` is set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/backend.go","lineNumber":459,"sourceCode":"\n\tbackendConfig := BackendConfig{\n\t\tAuthConfig:               authConfig,\n\t\tSubscriptionID:           data.String(\"subscription_id\"),\n\t\tResourceGroupName:        data.String(\"resource_group_name\"),\n\t\tStorageAccountName:       data.String(\"storage_account_name\"),\n\t\tLookupBlobEndpoint:       data.Bool(\"lookup_blob_endpoint\"),\n\t\tAccessKey:                data.String(\"access_key\"),\n\t\tSasToken:                 data.String(\"sas_token\"),\n\t\tUseAzureADAuthentication: data.Bool(\"use_azuread_auth\"),\n\t}\n\n\tneedToLookupAccessKey := backendConfig.AccessKey == \"\" && backendConfig.SasToken == \"\" && !backendConfig.UseAzureADAuthentication\n\tif backendConfig.ResourceGroupName == \"\" {\n\t\tif needToLookupAccessKey {\n\t\t\treturn backendbase.ErrorAsDiagnostics(fmt.Errorf(\"One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified\"))\n\t\t}\n\t\tif backendConfig.LookupBlobEndpoint {\n\t\t\treturn backendbase.ErrorAsDiagnostics(fmt.Errorf(\"`resource_group_name` is required when `lookup_blob_endpoint` is set\"))\n\t\t}\n\t}\n\n\tclient, err := buildClient(ctx, backendConfig)\n\tif err != nil {\n\t\treturn backendbase.ErrorAsDiagnostics(err)\n\t}\n\n\tb.apiClient = client\n\treturn nil\n}\n","sourceCodeStart":441,"sourceCodeEnd":471,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/backend.go#L441-L471","documentation":"A configuration-validation error in Backend.Configure (backend.go:458-460). The lookup_blob_endpoint option tells the backend to query ARM for the storage account's real primary blob endpoint (required for Azure DNS zone / private-endpoint endpoints). That ARM lookup needs resource_group_name to build the storage-account resource ID; without it the lookup is impossible, so Configure refuses.","triggerScenarios":"Produced at backend.go:458-459 when LookupBlobEndpoint is true and resource_group_name is empty. Triggered at 'terraform init' before any data-plane call.","commonSituations":"Enabling lookup_blob_endpoint (often set via ARM_USE_DNS_ZONE_ENDPOINT=true) for a storage account behind a private DNS zone but forgetting to set resource_group_name; an environment variable enabling the flag globally.","solutions":["Add resource_group_name to the backend block","Or disable lookup_blob_endpoint if your account uses the standard public blob endpoint","Check that ARM_USE_DNS_ZONE_ENDPOINT env var is not unintentionally set to true"],"exampleFix":"// before: lookup enabled but no resource group\nterraform {\n  backend \"azurerm\" {\n    storage_account_name  = \"mystage\"\n    container_name        = \"tfstate\"\n    key                   = \"prod.tfstate\"\n    lookup_blob_endpoint  = true\n  }\n}\n\n// after: provide resource_group_name (and subscription_id)\nterraform {\n  backend \"azurerm\" {\n    resource_group_name   = \"rg-tfstate\"\n    storage_account_name  = \"mystage\"\n    container_name        = \"tfstate\"\n    key                   = \"prod.tfstate\"\n    lookup_blob_endpoint  = true\n    subscription_id       = \"00000000-0000-0000-0000-000000000000\"\n  }\n}","handlingStrategy":"validation","validationCode":"# When lookup_blob_endpoint is enabled, require resource_group_name\nLOOKUP=\"${ARM_USE_DNS_ZONE_ENDPOINT:-false}\"\nif [ \"$LOOKUP\" = true ] || [ \"$LOOKUP\" = 1 ]; then\n  [ -n \"$ARM_RESOURCE_GROUP_NAME\" ] && echo \"OK\" || { echo \"FAIL: resource_group_name required with lookup_blob_endpoint (error 147)\"; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["If you set ARM_USE_DNS_ZONE_ENDPOINT=true globally, also set ARM_RESOURCE_GROUP_NAME","Treat lookup_blob_endpoint and resource_group_name as a required pair","Audit env vars in CI for the DNS-zone flag without a resource group"],"tags":["azure","configuration","validation","endpoint","dns-zone"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}