goreleaser/goreleaser · error

missing azure storage key for provided bucket %s: %w

Error message

missing azure storage key for provided bucket %s: %w

What it means

handleError maps the Azure error ServiceCode=ResourceNotFound to this message: the storage request reached the account but the target container (or resource) was not found — typically because no valid auth key is present the account treats the request as anonymous, or the container itself doesn't exist.

Source

Thrown at internal/pipe/blob/upload.go:225

	return false
}

func handleError(err error, url string) error {
	switch {
	case errorContains(err, "NoSuchBucket", "ContainerNotFound", "notFound"):
		return fmt.Errorf("provided bucket does not exist: %s: %w", url, err)
	case errorContains(err, "NoCredentialProviders"):
		return fmt.Errorf("check credentials and access to bucket: %s: %w", url, err)
	case errorContains(err, "InvalidAccessKeyId"):
		return fmt.Errorf("aws access key id you provided does not exist in our records: %w", err)
	case errorContains(err, "AuthenticationFailed"):
		return fmt.Errorf("azure storage key you provided is not valid: %w", err)
	case errorContains(err, "invalid_grant"):
		return fmt.Errorf("google app credentials you provided is not valid: %w", err)
	case errorContains(err, "no such host"):
		return fmt.Errorf("azure storage account you provided is not valid: %w", err)
	case errorContains(err, "ServiceCode=ResourceNotFound"):
		return fmt.Errorf("missing azure storage key for provided bucket %s: %w", url, err)
	default:
		return fmt.Errorf("failed to write to bucket: %w", err)
	}
}

func getData(ctx *context.Context, conf config.Blob, path string) ([]byte, error) {
	data, err := os.ReadFile(path)
	if err != nil {
		return data, fmt.Errorf("failed to open file %s: %w", path, err)
	}
	if conf.KMSKey == "" {
		return data, nil
	}
	keeper, err := secrets.OpenKeeper(ctx, conf.KMSKey)
	if err != nil {
		return data, fmt.Errorf("failed to open kms %s: %w", conf.KMSKey, err)
	}
	defer keeper.Close()

View on GitHub (pinned to f5edd73956)

Solutions

1. Set AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY in the environment so requests are authenticated
2. Verify the container exists: az storage container list --account-name <account>
3. Fix the container name (blob: config) to exactly match the existing container
4. Create the missing container before the release runs

Example fix

# before
blobs:
  - provider: azure
    bucket: existing-account
    # key never provided -> ResourceNotFound
# after
blobs:
  - provider: azure
    bucket: existing-account
# and in CI env:
# AZURE_STORAGE_ACCOUNT / AZURE_STORAGE_KEY set

az storage container exists \
  --account-name "$AZURE_STORAGE_ACCOUNT" \
  --name "releases" \
  --query exists -o tsv | grep -q true || { echo "container missing or no key set"; exit 1; }

When it happens

Trigger: Azure Blob upload where the container name in blob config does not exist, or AZURE_STORAGE_KEY is unset/empty so requests are unauthenticated and Azure returns ResourceNotFound for the container.

Common situations: Forgot to set the Azure key secret in CI; container deleted between releases; container name typo; container created with a different name/case.

Related errors

• azure storage key you provided is not valid: %w
• provided bucket does not exist: %s: %w
• check credentials and access to bucket: %s: %w
• azure storage account you provided is not valid: %w
• aws access key id you provided does not exist in our records

AI-assisted analysis of goreleaser/goreleaser@f5edd73956 (2026-09-05). Data as JSON: /api/errors/097a1a4f1e259980. Report an issue: GitHub.