{"record":{"id":"4dafaafc28c61651","repo":"hashicorp/terraform","slug":"unable-to-build-authorizer-for-storage-api-v","errorCode":null,"errorMessage":"unable to build authorizer for Storage API: %+v","messagePattern":"unable to build authorizer for Storage API: %\\+v","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":64,"sourceCode":"\t\tenvironment:        config.AuthConfig.Environment,\n\t\tstorageAccountName: config.StorageAccountName,\n\t}\n\n\tvar armAuthRequired bool\n\tswitch {\n\tcase config.AccessKey != \"\":\n\t\tclient.accessKey = config.AccessKey\n\tcase config.SasToken != \"\":\n\t\tsasToken := config.SasToken\n\t\tif strings.TrimSpace(sasToken) == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"sasToken cannot be empty\")\n\t\t}\n\t\tclient.sasToken = strings.TrimPrefix(sasToken, \"?\")\n\tcase config.UseAzureADAuthentication:\n\t\tvar err error\n\t\tclient.azureAdStorageAuth, err = auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.Storage)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to build authorizer for Storage API: %+v\", err)\n\t\t}\n\tdefault:\n\t\t// AAD authentication (ARM scope) is required only when no auth method is specified, which falls back to listing the access key via ARM API.\n\t\tarmAuthRequired = true\n\t}\n\n\t// If `config.LookupBlobEndpoint` is true, we need to authenticate with ARM to lookup the blob endpoint\n\tif config.LookupBlobEndpoint {\n\t\tarmAuthRequired = true\n\t}\n\n\tif armAuthRequired {\n\t\tresourceManagerAuth, err := auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.ResourceManager)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to build authorizer for Resource Manager API: %+v\", err)\n\t\t}\n\n\t\t// When using Azure CLI to auth, the user can leave the \"subscription_id\" unspecified. In this case the subscription id is inferred from","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/api_client.go#L46-L82","documentation":"Returned by buildClient when use_azuread_authentication=true and auth.NewAuthorizerFromCredentials fails to build an authorizer for the Storage (data-plane) API. The %+v wraps the underlying auth error, which usually describes missing/invalid credentials or an unsupported auth configuration.","triggerScenarios":"Configuring the azurerm backend with use_azuread_authentication = true, and the AuthConfig credentials (client id/secret, tenant, etc., or CLI/managed identity) cannot produce a Storage-scope token. Fails during terraform init/Configure.","commonSituations":"Missing ARM_CLIENT_ID/ARM_CLIENT_SECRET/ARM_TENANT_ID env vars; client secret expired; the service principal lacks Storage data-plane permissions; misconfigured environment metadata; using MSI in an environment where the metadata endpoint is unreachable.","solutions":["Verify all required Azure AD credential env vars (ARM_CLIENT_ID, ARM_CLIENT_SECRET or ARM_USE_MSI, ARM_TENANT_ID) are set and valid.","Ensure the service principal / managed identity has 'Storage Blob Data Contributor' or equivalent data-plane role on the storage account.","Check the environment/endpoint config and network access to Azure AD and Storage endpoints."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify required AAD credential env vars before init when using Azure AD storage auth.\nfor _, k := range []string{\"ARM_CLIENT_ID\", \"ARM_TENANT_ID\"} {\n    if os.Getenv(k) == \"\" { return fmt.Errorf(\"%s required for Azure AD storage auth\", k) }\n}","typeGuard":null,"tryCatchPattern":"client, err := buildClient(ctx, config)\nif err != nil && strings.Contains(err.Error(), \"build authorizer for Storage API\") {\n    // guide user to AAD credential / RBAC issues\n}","preventionTips":["Pre-validate all ARM_* credential env vars in a pre-flight script.","Grant the principal Storage Blob Data Contributor before relying on AAD storage auth.","Use managed identity in Azure-hosted CI to avoid expired client secrets."],"tags":["azure","backend","auth","azure-ad","credentials","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}