{"record":{"id":"ada27da49276adcf","repo":"hashicorp/terraform","slug":"unable-to-build-authorizer-for-resource-manager-ap","errorCode":null,"errorMessage":"unable to build authorizer for Resource Manager API: %+v","messagePattern":"unable to build authorizer for Resource Manager API: %\\+v","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":79,"sourceCode":"\t\tvar err error\n\t\tclient.azureAdStorageAuth, err = auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.Storage)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to build authorizer for Storage API: %+v\", err)\n\t\t}\n\tdefault:\n\t\t// AAD authentication (ARM scope) is required only when no auth method is specified, which falls back to listing the access key via ARM API.\n\t\tarmAuthRequired = true\n\t}\n\n\t// If `config.LookupBlobEndpoint` is true, we need to authenticate with ARM to lookup the blob endpoint\n\tif config.LookupBlobEndpoint {\n\t\tarmAuthRequired = true\n\t}\n\n\tif armAuthRequired {\n\t\tresourceManagerAuth, err := auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.ResourceManager)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to build authorizer for Resource Manager API: %+v\", err)\n\t\t}\n\n\t\t// When using Azure CLI to auth, the user can leave the \"subscription_id\" unspecified. In this case the subscription id is inferred from\n\t\t// the Azure CLI default subscription.\n\t\tif config.SubscriptionID == \"\" {\n\t\t\tif cachedAuth, ok := resourceManagerAuth.(*auth.CachedAuthorizer); ok {\n\t\t\t\tif cliAuth, ok := cachedAuth.Source.(*auth.AzureCliAuthorizer); ok && cliAuth.DefaultSubscriptionID != \"\" {\n\t\t\t\t\tconfig.SubscriptionID = cliAuth.DefaultSubscriptionID\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif config.SubscriptionID == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"subscription id not specified\")\n\t\t}\n\n\t\t// Setup the SA client.\n\t\tclient.storageAccountsClient, err = storageaccounts.NewStorageAccountsClientWithBaseURI(config.AuthConfig.Environment.ResourceManager)\n\t\tif err != nil {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/api_client.go#L61-L97","documentation":"Returned by buildClient when ARM authorizer is required (no access key/SAS/AAD-storage provided, or lookup_blob_endpoint=true) and auth.NewAuthorizerFromCredentials fails for the Resource Manager (management-plane) scope. The %+v wraps the underlying credential/auth error.","triggerScenarios":"The Azure backend needs to call the ARM API (to list access keys or look up the blob endpoint) but cannot authenticate to Resource Manager. Fails during terraform init when building the client. Common when no explicit access key/SAS is given (default path) so Terraform must list keys via ARM.","commonSituations":"ARM_CLIENT_ID/SECRET/TENANT not set or expired; using Azure CLI auth in a session where 'az login' was not run or expired; MSI unavailable; network blocking login.microsoftonline.com; wrong cloud environment configured.","solutions":["Provide valid ARM credentials: set ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID (or use ARM_USE_MSI=true / Azure CLI login).","If using CLI auth, run 'az login' and ensure ARM_SUBSCRIPTION_ID/ARM_TENANT_ID are set or inferable.","Set an explicit access_key or sas_token to avoid needing ARM auth entirely.","Verify the cloud environment (ARM_ENVIRONMENT) matches where the principal exists."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// When no explicit key/SAS, ARM creds are mandatory — check them up front.\nif config.AccessKey == \"\" && config.SasToken == \"\" && !config.UseAzureADAuthentication {\n    for _, k := range []string{\"ARM_CLIENT_ID\", \"ARM_CLIENT_SECRET\", \"ARM_TENANT_ID\"} {\n        if os.Getenv(k) == \"\" { return fmt.Errorf(\"%s required for ARM auth\", k) }\n    }\n}","typeGuard":null,"tryCatchPattern":"client, err := buildClient(ctx, config)\nif err != nil && strings.Contains(err.Error(), \"build authorizer for Resource Manager\") {\n    // point to ARM credential / CLI login / network issues\n}","preventionTips":["Run 'az login' and 'az account set' before CLI-based auth runs.","Rotate and re-set ARM client secrets before expiry; alert on expiry.","Provide an explicit access_key or SAS to remove the ARM-auth dependency."],"tags":["azure","backend","auth","resource-manager","credentials","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}