{"record":{"id":"40313671d87d1553","repo":"hashicorp/terraform","slug":"unable-to-determine-the-write-key-for-s","errorCode":null,"errorMessage":"unable to determine the Write Key for %s","messagePattern":"unable to determine the Write Key for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/storage_client_helpers.go","lineNumber":83,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"listing Keys for %s: %+v\", ad.StorageAccountId, err)\n\t}\n\n\tif model := listKeysResp.Model; model != nil && model.Keys != nil {\n\t\tfor _, key := range *model.Keys {\n\t\t\tif key.Permissions == nil || key.Value == nil {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif *key.Permissions == storageaccounts.KeyPermissionFull {\n\t\t\t\tad.accountKey = key.Value\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\n\tif ad.accountKey == nil {\n\t\treturn nil, fmt.Errorf(\"unable to determine the Write Key for %s\", ad.StorageAccountId)\n\t}\n\n\treturn ad.accountKey, nil\n}\n\nfunc (ad *AccountDetails) DataPlaneEndpoint(endpointType EndpointType) (*string, error) {\n\tvar baseUri *string\n\tswitch endpointType {\n\tcase EndpointTypeBlob:\n\t\tbaseUri = ad.primaryBlobEndpoint\n\n\tcase EndpointTypeDfs:\n\t\tbaseUri = ad.primaryDfsEndpoint\n\n\tcase EndpointTypeFile:\n\t\tbaseUri = ad.primaryFileEndpoint\n\n\tcase EndpointTypeQueue:","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/storage_client_helpers.go#L65-L101","documentation":"After ListKeys succeeds, AccountKey (storage_client_helpers.go:83) scans the returned keys for one whose Permissions equals KeyPermissionFull and whose Value is non-nil. If none qualifies (keys empty, all permissions nil, or only restricted keys), it cannot pick a usable write key and fails.","triggerScenarios":"ListKeys returns a model with no keys, keys whose Value/Permissions are nil, or only non-Full keys, so the loop at storage_client_helpers.go:69-79 never sets accountKey.","commonSituations":"Account in a degraded or mid-rotation key state; partial ListKeys response; API-version skew returning an unexpected key shape; key retrieval returning empty for a misconfigured account.","solutions":["Regenerate the storage account keys then retry: `az storage account keys renew`.","Confirm the account is healthy and not mid-rotation.","Use a different backend auth mode (SAS, managed identity) instead of access keys.","Verify the go-azure-sdk storageaccounts API version matches the cloud's response shape."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# confirm at least one Full-permission key exists\naz storage account keys list \\\n  --account-name <acct> --resource-group <rg> \\\n  --query \"[?permissions=='Full'].value | length(@)\" --output tsv | grep -qv '^0$' \\\n  || echo \"WARN: no Full-permission storage key available\"","typeGuard":"// verify the ListKeys model contains a usable Full key\nfunc hasFullKey(model *storageaccounts.ListKeysResult) bool {\n    if model == nil || model.Keys == nil {\n        return false\n    }\n    for _, k := range *model.Keys {\n        if k.Permissions != nil && *k.Permissions == storageaccounts.KeyPermissionFull && k.Value != nil {\n            return true\n        }\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Avoid mid-rotation when running terraform; complete key renewal first.","Prefer SAS or managed-identity backend auth to avoid key dependence.","Monitor storage account health before runs."],"tags":["azure","storage","arm","keys"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}