{"record":{"id":"def9ae779dbd6a90","repo":"hashicorp/terraform","slug":"new-blob-client-v","errorCode":null,"errorMessage":"new blob client: %v","messagePattern":"new blob client: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":148,"sourceCode":"\n\tvar baseUri string\n\tif c.accountDetail != nil {\n\t\t// Use the actual blob endpoint if available\n\t\tpBaseUri, err := c.accountDetail.DataPlaneEndpoint(EndpointTypeBlob)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tbaseUri = *pBaseUri\n\t} else {\n\t\tbaseUri, err = naiveStorageAccountBlobBaseURL(c.environment, c.storageAccountName)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tblobsClient, err := blobs.NewWithBaseUri(baseUri)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"new blob client: %v\", err)\n\t}\n\n\tswitch {\n\tcase c.sasToken != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Blob Client from a SAS Token\")\n\t\tc.configureClient(blobsClient.Client, nil)\n\t\tblobsClient.Client.AppendRequestMiddleware(func(r *http.Request) (*http.Request, error) {\n\t\t\tif r.URL.RawQuery == \"\" {\n\t\t\t\tr.URL.RawQuery = c.sasToken\n\t\t\t} else if !strings.Contains(r.URL.RawQuery, c.sasToken) {\n\t\t\t\tr.URL.RawQuery = fmt.Sprintf(\"%s&%s\", r.URL.RawQuery, c.sasToken)\n\t\t\t}\n\t\t\treturn r, nil\n\t\t})\n\t\treturn blobsClient, nil\n\n\tcase c.accessKey != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Blob Client from an Access Key\")","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/api_client.go#L130-L166","documentation":"Returned by Client.getBlobClient when blobs.NewWithBaseUri fails to construct the data-plane blob client from the resolved base URI (either the looked-up blob endpoint or the naive derived URL). The %v wraps the URI/client construction error.","triggerScenarios":"Building the blob client lazily (first state read/write) and the computed blob base URI is invalid/empty/malformed so NewWithBaseUri rejects it. Triggered on the first state operation against the Azure blob backend.","commonSituations":"The storage account name or environment produces an invalid blob hostname (e.g. uppercase/illegal chars, empty account name); a custom environment with no blob suffix; populateAccountDetails returned an empty endpoint that wasn't caught earlier.","solutions":["Ensure storage_account_name is lowercase, valid, and non-empty (Azure blob hostnames must be lowercase).","Verify the environment's blob endpoint suffix is set for custom/airgapped clouds.","If lookup_blob_endpoint is on, confirm the retrieved endpoint is a valid absolute URL."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate the storage account name and derived blob URL before use.\nname := strings.ToLower(strings.TrimSpace(config.StorageAccountName))\nif name == \"\" || !validStorageName(name) {\n    return errors.New(\"storage_account_name must be a non-empty lowercase DNS name\")\n}","typeGuard":null,"tryCatchPattern":"bc, err := c.getBlobClient(ctx)\nif err != nil && strings.Contains(err.Error(), \"new blob client\") {\n    // verify account name and environment blob suffix\n}","preventionTips":["Use lowercase, DNS-valid storage account names only.","Confirm the environment's blob endpoint suffix is configured for custom clouds.","Validate the resolved blob endpoint URL is absolute before constructing the client."],"tags":["azure","backend","blob","client-construction","storage-account","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}