{"record":{"id":"2baa9958bc0dde46","repo":"hashicorp/terraform","slug":"new-shared-key-authorizer-v","errorCode":null,"errorMessage":"new shared key authorizer: %v","messagePattern":"new shared key authorizer: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":169,"sourceCode":"\tswitch {\n\tcase c.sasToken != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Blob Client from a SAS Token\")\n\t\tc.configureClient(blobsClient.Client, nil)\n\t\tblobsClient.Client.AppendRequestMiddleware(func(r *http.Request) (*http.Request, error) {\n\t\t\tif r.URL.RawQuery == \"\" {\n\t\t\t\tr.URL.RawQuery = c.sasToken\n\t\t\t} else if !strings.Contains(r.URL.RawQuery, c.sasToken) {\n\t\t\t\tr.URL.RawQuery = fmt.Sprintf(\"%s&%s\", r.URL.RawQuery, c.sasToken)\n\t\t\t}\n\t\t\treturn r, nil\n\t\t})\n\t\treturn blobsClient, nil\n\n\tcase c.accessKey != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Blob Client from an Access Key\")\n\t\tauthorizer, err := auth.NewSharedKeyAuthorizer(c.storageAccountName, c.accessKey, auth.SharedKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new shared key authorizer: %v\", err)\n\t\t}\n\t\tc.configureClient(blobsClient.Client, authorizer)\n\t\treturn blobsClient, nil\n\n\tcase c.azureAdStorageAuth != nil:\n\t\tlog.Printf(\"[DEBUG] Building the Blob Client from AAD auth\")\n\t\tc.configureClient(blobsClient.Client, c.azureAdStorageAuth)\n\t\treturn blobsClient, nil\n\n\tdefault:\n\t\t// Neither shared access key, sas token, or AAD Auth were specified so we have to call the management plane API to get the key.\n\t\tlog.Printf(\"[DEBUG] Building the Blob Client from an Access Key (key is listed using client credentials)\")\n\t\tkey, err := c.accountDetail.AccountKey(ctx, c.storageAccountsClient)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"retrieving key for Storage Account %q: %s\", c.storageAccountName, err)\n\t\t}\n\t\tauthorizer, err := auth.NewSharedKeyAuthorizer(c.storageAccountName, *key, auth.SharedKey)\n\t\tif err != nil {","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/api_client.go#L151-L187","documentation":"Returned by Client.getBlobClient (and analogously in getContainersClient) when auth.NewSharedKeyAuthorizer fails for the storage account name + access key. SharedKey auth signs requests using the account name and key; construction fails if the key is malformed (not valid base64) or the inputs are invalid.","triggerScenarios":"Building the blob/containers client using access_key auth (explicit access_key, or the default path that lists keys via ARM) and NewSharedKeyAuthorizer rejects the key — typically invalid base64 or empty key. Triggered on the first data-plane state operation.","commonSituations":"ARM_ACCESS_KEY env var contains a truncated/corrupt key; key copied with extra whitespace or quotes; storage key rotated but the configured key is stale; key listed from ARM returned empty due to permissions.","solutions":["Re-copy the correct, current storage account access key (Azure portal > Access keys) without extra whitespace.","Verify ARM_ACCESS_KEY (or access_key in the backend block) is valid base64 and complete.","If using key-listing via ARM, ensure the principal can list keys (Storage Account Contributor / listKeys action)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Sanity-check a base64 access key before constructing the authorizer.\nif _, err := base64.StdEncoding.DecodeString(config.AccessKey); err != nil {\n    return fmt.Errorf(\"access_key is not valid base64: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"bc, err := c.getBlobClient(ctx)\nif err != nil && strings.Contains(err.Error(), \"new shared key authorizer\") {\n    // the access key is malformed/stale; re-copy the current key\n}","preventionTips":["Copy storage access keys in full without trailing whitespace or quotes.","Rotate keys in Azure and update config promptly to avoid stale keys.","When listing keys via ARM, ensure the principal has the listKeys permission."],"tags":["azure","backend","auth","shared-key","access-key","blob","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}