{"record":{"id":"cc61cc3a452362c8","repo":"hashicorp/terraform","slug":"retrieving-container-client-v","errorCode":null,"errorMessage":"retrieving container client: %v","messagePattern":"retrieving container client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/backend_state.go","lineNumber":37,"sourceCode":")\n\nconst (\n\t// This will be used as directory name, the odd looking colon is simply to\n\t// reduce the chance of name conflicts with existing objects.\n\tkeyEnvPrefix = \"env:\"\n)\n\nfunc (b *Backend) Workspaces() ([]string, tfdiags.Diagnostics) {\n\tvar diags tfdiags.Diagnostics\n\tprefix := b.keyName + keyEnvPrefix\n\tparams := containers.ListBlobsInput{\n\t\tPrefix: &prefix,\n\t}\n\n\tctx := newCtx()\n\tclient, err := b.apiClient.getContainersClient(ctx)\n\tif err != nil {\n\t\treturn nil, diags.Append(fmt.Errorf(\"retrieving container client: %v\", err))\n\t}\n\tresp, err := client.ListBlobs(ctx, b.containerName, params)\n\tif err != nil {\n\t\treturn nil, diags.Append(fmt.Errorf(\"listing blobs: %v\", err))\n\t}\n\n\tenvs := map[string]struct{}{}\n\tfor _, obj := range resp.Blobs.Blobs {\n\t\tkey := obj.Name\n\t\tif strings.HasPrefix(key, prefix) {\n\t\t\tname := strings.TrimPrefix(key, prefix)\n\t\t\t// we store the state in a key, not a directory\n\t\t\tif strings.Contains(name, \"/\") {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tenvs[name] = struct{}{}\n\t\t}","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/backend_state.go#L19-L55","documentation":"A wrapper error from Backend.Workspaces (backend_state.go:35-37). To list workspaces, the backend lazily builds the containers client via getContainersClient; if that construction fails (auth, key retrieval, or endpoint/URL problems), the error is surfaced here. It is an aggregate whose root cause is one of errors 142-145.","triggerScenarios":"Produced at backend_state.go:35-37 during 'terraform workspace list/new/delete' when b.apiClient.getContainersClient(ctx) returns an error. The underlying cause is reported after the colon.","commonSituations":"Running 'terraform workspace list' with a misconfigured or expired credential; enabling lookup_blob_endpoint without resource_group_name; a SAS token that lacks container-list permission; a storage account the credential cannot reach.","solutions":["Read the message after 'retrieving container client:' to identify the root cause (auth, endpoint, or key)","Fix the underlying auth/endpoint issue (see the corresponding error 142-145 remediation)","Run 'terraform init -reconfigure' to rebuild the backend client from scratch","Verify the credential works against the data plane: az storage container list --account-name <account> --auth-mode login"],"exampleFix":"// before: SAS token without container-list permission causes client failure\nterraform {\n  backend \"azurerm\" {\n    storage_account_name = \"mystage\"\n    sas_token            = \"sv=...&ss=f&srt=o\"  // only file service, object scope\n    ...\n  }\n}\n\n// after: SAS granted service=b, resource types=co (service+container+object)\nterraform {\n  backend \"azurerm\" {\n    storage_account_name = \"mystage\"\n    sas_token            = \"sv=...&ss=b&srt=sco&sp=rl\"\n    ...\n  }\n}","handlingStrategy":"validation","validationCode":"# Pre-flight: can we build the containers client (auth + endpoint)?\naz storage container show --account-name \"$ARM_STORAGE_ACCOUNT_NAME\" -n \"$ARM_CONTAINER_NAME\" --auth-mode login >/dev/null 2>&1 \\\n  && echo \"OK: container reachable\" || echo \"WARN: container/auth/endpoint issue -> error 148 possible; run 'terraform init -reconfigure' after fixing\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the SAS token grants service=b with srt=sco and sp includes list","Run 'terraform init -reconfigure' after changing auth to rebuild the cached client","Confirm container_name exists before listing workspaces"],"tags":["azure","storage","workspace","container","authentication"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}