{"record":{"id":"c3793525b141a90e","repo":"benbjohnson/litestream","slug":"abs-cannot-create-default-azure-credential-w","errorCode":null,"errorMessage":"abs: cannot create default azure credential: %w","messagePattern":"abs: cannot create default azure credential: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"abs/replica_client.go","lineNumber":194,"sourceCode":"\t\tcredential, err := azblob.NewSharedKeyCredential(c.AccountName, accountKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create shared key credential: %w\", err)\n\t\t}\n\t\tclient, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with shared key: %w\", err)\n\t\t}\n\t} else {\n\t\t// Use default credential chain (similar to AWS SDK default credential chain)\n\t\t// This includes:\n\t\t// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)\n\t\t// - Managed Identity (for Azure VMs, App Service, etc.)\n\t\t// - Azure CLI credentials\n\t\t// - Visual Studio Code credentials\n\t\tslog.Debug(\"using default credential chain (managed identity, Azure CLI, environment variables, etc.)\")\n\t\tcredential, err := azidentity.NewDefaultAzureCredential(nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create default azure credential: %w\", err)\n\t\t}\n\t\tclient, err = azblob.NewClient(endpoint, credential, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with default credential: %w\", err)\n\t\t}\n\t}\n\n\tc.client = client\n\treturn nil\n}\n\n// LTXFiles returns an iterator over all available LTX files.\n// Azure always uses accurate timestamps from metadata since they're included in LIST operations at zero cost.\n// The useMetadata parameter is ignored.\nfunc (c *ReplicaClient) LTXFiles(ctx context.Context, level int, seek ltx.TXID, useMetadata bool) (ltx.FileIterator, error) {\n\tif err := c.Init(ctx); err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/abs/replica_client.go#L176-L212","documentation":"Construction of Azure's DefaultAzureCredential chain failed during abs.ReplicaClient.Init. This is the fallback path used when no shared key is configured, so it fires when the SDK can find no usable credential source: AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET env vars are incomplete, the workload has no managed identity, and the Azure CLI is not logged in.","triggerScenarios":"Thrown at abs/replica_client.go:194 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_CLIENT_SECRET environment variables for a service principal","Run 'az login' so the Azure CLI credential works","Assign a managed identity when running on an Azure VM or App Service","Alternatively configure account-name/account-key to use shared key credentials instead"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}