{"record":{"id":"bdc065fbbea7b5e1","repo":"hashicorp/terraform","slug":"one-of-access-key-sas-token-use-azuread-aut","errorCode":null,"errorMessage":"One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified","messagePattern":"One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/backend.go","lineNumber":456,"sourceCode":"\t\tEnableAuthenticationUsingGitHubOIDC:        enableOidc,\n\t\tEnableAuthenticationUsingADOPipelineOIDC:   enableOidc,\n\t}\n\n\tbackendConfig := BackendConfig{\n\t\tAuthConfig:               authConfig,\n\t\tSubscriptionID:           data.String(\"subscription_id\"),\n\t\tResourceGroupName:        data.String(\"resource_group_name\"),\n\t\tStorageAccountName:       data.String(\"storage_account_name\"),\n\t\tLookupBlobEndpoint:       data.Bool(\"lookup_blob_endpoint\"),\n\t\tAccessKey:                data.String(\"access_key\"),\n\t\tSasToken:                 data.String(\"sas_token\"),\n\t\tUseAzureADAuthentication: data.Bool(\"use_azuread_auth\"),\n\t}\n\n\tneedToLookupAccessKey := backendConfig.AccessKey == \"\" && backendConfig.SasToken == \"\" && !backendConfig.UseAzureADAuthentication\n\tif backendConfig.ResourceGroupName == \"\" {\n\t\tif needToLookupAccessKey {\n\t\t\treturn backendbase.ErrorAsDiagnostics(fmt.Errorf(\"One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified\"))\n\t\t}\n\t\tif backendConfig.LookupBlobEndpoint {\n\t\t\treturn backendbase.ErrorAsDiagnostics(fmt.Errorf(\"`resource_group_name` is required when `lookup_blob_endpoint` is set\"))\n\t\t}\n\t}\n\n\tclient, err := buildClient(ctx, backendConfig)\n\tif err != nil {\n\t\treturn backendbase.ErrorAsDiagnostics(err)\n\t}\n\n\tb.apiClient = client\n\treturn nil\n}\n","sourceCodeStart":438,"sourceCodeEnd":471,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/backend.go#L438-L471","documentation":"A hard configuration-validation error raised in Backend.Configure (backend.go:453-456). When resource_group_name is empty AND the backend would need to look up an access key via ARM (i.e. access_key, sas_token, and use_azuread_auth are all unset), Terraform cannot form the storage-account resource ID needed for the ListKeys call. Configure aborts before any network call.","triggerScenarios":"Produced at backend.go:454-456 when needToLookupAccessKey is true (no access_key, no sas_token, use_azuread_auth false) and backendConfig.ResourceGroupName == \"\". Happens at 'terraform init' once the backend block is parsed.","commonSituations":"Removing a previously-set access_key (e.g. after a key rotation) without adding resource_group_name; a backend block copy-pasted with only storage_account_name/container_name/key; relying purely on CLI auth but forgetting the resource group.","solutions":["Add resource_group_name (and subscription_id) to the backend block so ListKeys can run","Or set access_key, sas_token, or use_azuread_auth = true so key lookup is not required","If using env vars, export ARM_RESOURCE_GROUP_NAME / ARM_ACCESS_KEY / ARM_USE_AZUREAD=true as appropriate"],"exampleFix":"// before: no auth method, no resource group -> Configure fails\nterraform {\n  backend \"azurerm\" {\n    storage_account_name = \"mystage\"\n    container_name       = \"tfstate\"\n    key                  = \"prod.tfstate\"\n  }\n}\n\n// after: add resource_group_name so ARM key lookup can proceed\nterraform {\n  backend \"azurerm\" {\n    resource_group_name  = \"rg-tfstate\"\n    storage_account_name = \"mystage\"\n    container_name       = \"tfstate\"\n    key                  = \"prod.tfstate\"\n    subscription_id      = \"00000000-0000-0000-0000-000000000000\"\n  }\n}","handlingStrategy":"validation","validationCode":"# Enforce that at least one auth path is satisfiable before terraform init\nHAS_RG=\"${ARM_RESOURCE_GROUP_NAME:+yes}\"\nHAS_KEY=\"${ARM_ACCESS_KEY:+yes}\"\nHAS_SAS=\"${ARM_SAS_TOKEN:+yes}\"\nHAS_AAD=\"${ARM_USE_AZUREAD:+yes}\"\nif [ \"$HAS_RG\" != yes ] && [ \"$HAS_KEY$HAS_SAS$HAS_AAD\" = \"\" ]; then\n  echo \"FAIL: set resource_group_name OR access_key/sas_token/use_azuread_auth (error 146)\"\n  exit 1\nfi\necho \"OK: auth path available\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair a credential-only backend with resource_group_name + subscription_id","Run this check in CI before 'terraform init' to fail fast on incomplete config","Keep backend config under version control and review it on auth changes"],"tags":["azure","configuration","validation","authentication"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}