benbjohnson/litestream · error

abs: cannot create default azure credential: %w

Error message

abs: cannot create default azure credential: %w

What it means

Construction of Azure's DefaultAzureCredential chain failed during abs.ReplicaClient.Init. This is the fallback path used when no shared key is configured, so it fires when the SDK can find no usable credential source: AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET env vars are incomplete, the workload has no managed identity, and the Azure CLI is not logged in.

Source

Thrown at abs/replica_client.go:194

		credential, err := azblob.NewSharedKeyCredential(c.AccountName, accountKey)
		if err != nil {
			return fmt.Errorf("abs: cannot create shared key credential: %w", err)
		}
		client, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with shared key: %w", err)
		}
	} else {
		// Use default credential chain (similar to AWS SDK default credential chain)
		// This includes:
		// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)
		// - Managed Identity (for Azure VMs, App Service, etc.)
		// - Azure CLI credentials
		// - Visual Studio Code credentials
		slog.Debug("using default credential chain (managed identity, Azure CLI, environment variables, etc.)")
		credential, err := azidentity.NewDefaultAzureCredential(nil)
		if err != nil {
			return fmt.Errorf("abs: cannot create default azure credential: %w", err)
		}
		client, err = azblob.NewClient(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with default credential: %w", err)
		}
	}

	c.client = client
	return nil
}

// LTXFiles returns an iterator over all available LTX files.
// Azure always uses accurate timestamps from metadata since they're included in LIST operations at zero cost.
// The useMetadata parameter is ignored.
func (c *ReplicaClient) LTXFiles(ctx context.Context, level int, seek ltx.TXID, useMetadata bool) (ltx.FileIterator, error) {
	if err := c.Init(ctx); err != nil {
		return nil, err
	}

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Set AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_CLIENT_SECRET environment variables for a service principal
2. Run 'az login' so the Azure CLI credential works
3. Assign a managed identity when running on an Azure VM or App Service
4. Alternatively configure account-name/account-key to use shared key credentials instead

When it happens

Trigger: Thrown at abs/replica_client.go:194 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/c3793525b141a90e. Report an issue: GitHub.