What causes "new shared key authorizer: %v" in hashicorp/terraform?

Re-copy the correct, current storage account access key (Azure portal > Access keys) without extra whitespace.

new shared key authorizer: %v

Error message

new shared key authorizer: %v

What it means

Returned by Client.getBlobClient (and analogously in getContainersClient) when auth.NewSharedKeyAuthorizer fails for the storage account name + access key. SharedKey auth signs requests using the account name and key; construction fails if the key is malformed (not valid base64) or the inputs are invalid.

Source

Thrown at internal/backend/remote-state/azure/api_client.go:169

	switch {
	case c.sasToken != "":
		log.Printf("[DEBUG] Building the Blob Client from a SAS Token")
		c.configureClient(blobsClient.Client, nil)
		blobsClient.Client.AppendRequestMiddleware(func(r *http.Request) (*http.Request, error) {
			if r.URL.RawQuery == "" {
				r.URL.RawQuery = c.sasToken
			} else if !strings.Contains(r.URL.RawQuery, c.sasToken) {
				r.URL.RawQuery = fmt.Sprintf("%s&%s", r.URL.RawQuery, c.sasToken)
			}
			return r, nil
		})
		return blobsClient, nil

	case c.accessKey != "":
		log.Printf("[DEBUG] Building the Blob Client from an Access Key")
		authorizer, err := auth.NewSharedKeyAuthorizer(c.storageAccountName, c.accessKey, auth.SharedKey)
		if err != nil {
			return nil, fmt.Errorf("new shared key authorizer: %v", err)
		}
		c.configureClient(blobsClient.Client, authorizer)
		return blobsClient, nil

	case c.azureAdStorageAuth != nil:
		log.Printf("[DEBUG] Building the Blob Client from AAD auth")
		c.configureClient(blobsClient.Client, c.azureAdStorageAuth)
		return blobsClient, nil

	default:
		// Neither shared access key, sas token, or AAD Auth were specified so we have to call the management plane API to get the key.
		log.Printf("[DEBUG] Building the Blob Client from an Access Key (key is listed using client credentials)")
		key, err := c.accountDetail.AccountKey(ctx, c.storageAccountsClient)
		if err != nil {
			return nil, fmt.Errorf("retrieving key for Storage Account %q: %s", c.storageAccountName, err)
		}
		authorizer, err := auth.NewSharedKeyAuthorizer(c.storageAccountName, *key, auth.SharedKey)
		if err != nil {

View on GitHub (pinned to c9def3e214)

Solutions

Re-copy the correct, current storage account access key (Azure portal > Access keys) without extra whitespace.
Verify ARM_ACCESS_KEY (or access_key in the backend block) is valid base64 and complete.
If using key-listing via ARM, ensure the principal can list keys (Storage Account Contributor / listKeys action).

Defensive patterns

Strategy: validation

Validate before calling

// Sanity-check a base64 access key before constructing the authorizer.
if _, err := base64.StdEncoding.DecodeString(config.AccessKey); err != nil {
    return fmt.Errorf("access_key is not valid base64: %w", err)
}

Try / catch

bc, err := c.getBlobClient(ctx)
if err != nil && strings.Contains(err.Error(), "new shared key authorizer") {
    // the access key is malformed/stale; re-copy the current key
}

Prevention

Copy storage access keys in full without trailing whitespace or quotes.
Rotate keys in Azure and update config promptly to avoid stale keys.
When listing keys via ARM, ensure the principal has the listKeys permission.

When it happens

Trigger: Building the blob/containers client using access_key auth (explicit access_key, or the default path that lists keys via ARM) and NewSharedKeyAuthorizer rejects the key — typically invalid base64 or empty key. Triggered on the first data-plane state operation.

Common situations: ARM_ACCESS_KEY env var contains a truncated/corrupt key; key copied with extra whitespace or quotes; storage key rotated but the configured key is stale; key listed from ARM returned empty due to permissions.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/2baa9958bc0dde46. Report an issue: GitHub.