hashicorp/terraform · error

determining %s endpoint for %s: missing primary endpoint

Error message

determining %s endpoint for %s: missing primary endpoint

What it means

DataPlaneEndpoint (storage_client_helpers.go:112) returns the configured primary endpoint (blob/dfs/file/queue/table) for data-plane calls. If the requested endpoint type's pointer in AccountDetails is nil (never populated because ARM omitted it), the backend cannot build the data-plane URL.

Source

Thrown at internal/backend/remote-state/azure/storage_client_helpers.go:112

	case EndpointTypeDfs:
		baseUri = ad.primaryDfsEndpoint

	case EndpointTypeFile:
		baseUri = ad.primaryFileEndpoint

	case EndpointTypeQueue:
		baseUri = ad.primaryQueueEndpoint

	case EndpointTypeTable:
		baseUri = ad.primaryTableEndpoint

	default:
		return nil, fmt.Errorf("internal-error: unrecognised endpoint type %q when building storage client", endpointType)
	}

	if baseUri == nil {
		return nil, fmt.Errorf("determining %s endpoint for %s: missing primary endpoint", endpointType, ad.StorageAccountId)
	}
	return baseUri, nil
}

func populateAccountDetails(accountId commonids.StorageAccountId, account storageaccounts.StorageAccount) (*AccountDetails, error) {
	out := AccountDetails{
		Kind:             pointer.From(account.Kind),
		StorageAccountId: accountId,
	}

	if account.Properties == nil {
		return nil, fmt.Errorf("populating details for %s: `model.Properties` was nil", accountId)
	}
	if account.Properties.PrimaryEndpoints == nil {
		return nil, fmt.Errorf("populating details for %s: `model.Properties.PrimaryEndpoints` was nil", accountId)
	}

	props := *account.Properties

View on GitHub (pinned to c9def3e214)

Solutions

1. Enable the required feature on the storage account (e.g. hierarchical namespace for dfs, or enable the table service).
2. Use an endpoint type the account actually exposes (blob for standard LRS/GRS).
3. Verify the account kind (StorageV2/BlobStorage) supports the requested service.

# confirm the requested endpoint is exposed by the account
az storage account show --name <acct> --resource-group <rg> \
  --query "primaryEndpoints.<blob|dfs|table>" --output tsv | grep -q '.' \
  || echo "WARN: requested primary endpoint is not set"

// confirm the requested endpoint is populated before requesting it
func endpointAvailable(ad *AccountDetails, t EndpointType) bool {
    e, err := ad.DataPlaneEndpoint(t)
    return err == nil && e != nil
}

When it happens

Trigger: Requesting an endpoint type (e.g. dfs for a non-HNS account, or table) whose value was nil in the storage account Properties.PrimaryEndpoints returned by ARM, then calling DataPlaneEndpoint for that type.

Common situations: Using a standard non-HNS account and requesting a dfs endpoint; table/queue/file service disabled on the account; account kind/feature flags not enabling the requested service.

Related errors

• new container client: %v
• no storage domain suffix defined for environment: %s
• retrieving key for Storage Account %q: %s
• One of `access_key`, `sas_token`, `use_azuread_auth` and `re
• `resource_group_name` is required when `lookup_blob_endpoint

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/e36be47a51fc6d89. Report an issue: GitHub.