hashicorp/terraform · error

new blob client: %v

Error message

new blob client: %v

What it means

Returned by Client.getBlobClient when blobs.NewWithBaseUri fails to construct the data-plane blob client from the resolved base URI (either the looked-up blob endpoint or the naive derived URL). The %v wraps the URI/client construction error.

Source

Thrown at internal/backend/remote-state/azure/api_client.go:148

	var baseUri string
	if c.accountDetail != nil {
		// Use the actual blob endpoint if available
		pBaseUri, err := c.accountDetail.DataPlaneEndpoint(EndpointTypeBlob)
		if err != nil {
			return nil, err
		}
		baseUri = *pBaseUri
	} else {
		baseUri, err = naiveStorageAccountBlobBaseURL(c.environment, c.storageAccountName)
		if err != nil {
			return nil, err
		}
	}

	blobsClient, err := blobs.NewWithBaseUri(baseUri)
	if err != nil {
		return nil, fmt.Errorf("new blob client: %v", err)
	}

	switch {
	case c.sasToken != "":
		log.Printf("[DEBUG] Building the Blob Client from a SAS Token")
		c.configureClient(blobsClient.Client, nil)
		blobsClient.Client.AppendRequestMiddleware(func(r *http.Request) (*http.Request, error) {
			if r.URL.RawQuery == "" {
				r.URL.RawQuery = c.sasToken
			} else if !strings.Contains(r.URL.RawQuery, c.sasToken) {
				r.URL.RawQuery = fmt.Sprintf("%s&%s", r.URL.RawQuery, c.sasToken)
			}
			return r, nil
		})
		return blobsClient, nil

	case c.accessKey != "":
		log.Printf("[DEBUG] Building the Blob Client from an Access Key")

View on GitHub (pinned to c9def3e214)

Solutions

1. Ensure storage_account_name is lowercase, valid, and non-empty (Azure blob hostnames must be lowercase).
2. Verify the environment's blob endpoint suffix is set for custom/airgapped clouds.
3. If lookup_blob_endpoint is on, confirm the retrieved endpoint is a valid absolute URL.

// Validate the storage account name and derived blob URL before use.
name := strings.ToLower(strings.TrimSpace(config.StorageAccountName))
if name == "" || !validStorageName(name) {
    return errors.New("storage_account_name must be a non-empty lowercase DNS name")
}

bc, err := c.getBlobClient(ctx)
if err != nil && strings.Contains(err.Error(), "new blob client") {
    // verify account name and environment blob suffix
}

When it happens

Trigger: Building the blob client lazily (first state read/write) and the computed blob base URI is invalid/empty/malformed so NewWithBaseUri rejects it. Triggered on the first state operation against the Azure blob backend.

Common situations: The storage account name or environment produces an invalid blob hostname (e.g. uppercase/illegal chars, empty account name); a custom environment with no blob suffix; populateAccountDetails returned an empty endpoint that wasn't caught earlier.

Related errors

• building Storage Accounts client: %+v
• retrieving %s: %+v
• retrieving %s: model was nil
• populating details for %s: %+v
• new shared key authorizer: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/def9ae779dbd6a90. Report an issue: GitHub.