hashicorp/terraform · error

no storage domain suffix defined for environment: %s

Error message

no storage domain suffix defined for environment: %s

What it means

naiveStorageAccountBlobBaseURL (storage_client_helpers.go:163) builds a blob URL from the environment's Storage.DomainSuffix (e.g. core.windows.net). If the selected environment does not define one (ok=false), it cannot synthesize the URL and fails.

Source

Thrown at internal/backend/remote-state/azure/storage_client_helpers.go:163

	}
	if endpoints.Queue != nil {
		endpoint := strings.TrimSuffix(*endpoints.Queue, "/")
		out.primaryQueueEndpoint = pointer.To(endpoint)
	}
	if endpoints.Table != nil {
		endpoint := strings.TrimSuffix(*endpoints.Table, "/")
		out.primaryTableEndpoint = pointer.To(endpoint)
	}

	return &out, nil
}

// naiveStorageAccountBlobBaseURL naively construct the storage account blob endpoint URL instead of
// learning from the storage account response. This can be incorrect if private dns zone is used.
func naiveStorageAccountBlobBaseURL(e environments.Environment, accountName string) (string, error) {
	pDomainSuffix, ok := e.Storage.DomainSuffix()
	if !ok {
		return "", fmt.Errorf("no storage domain suffix defined for environment: %s", e.Name)
	}
	return fmt.Sprintf("https://%s.blob.%s", accountName, *pDomainSuffix), nil
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Use a fully-supported environment name (Public, China, USGovernment, etc.).
2. Provide complete custom environment metadata including the storage suffix.
3. Avoid the naive path by ensuring primary endpoints are read from ARM instead.

Example fix

# before
export ARM_ENVIRONMENT=MyCustomCloud   # no storage suffix defined
# after
export ARM_ENVIRONMENT=AzurePublicCloud

# confirm the environment defines a storage domain suffix
az cloud show --name "$(az cloud show --query name -o tsv)" \
  --query "suffixes.storageEndpoint" --output tsv | grep -q '.' \
  || echo "WARN: no storage domain suffix for this cloud"

// confirm the environment exposes a storage suffix before building a naive URL
func hasStorageSuffix(e environments.Environment) bool {
    _, ok := e.Storage.DomainSuffix()
    return ok
}

When it happens

Trigger: Selecting a custom/sovereign environment (via ARM_ENVIRONMENT or a metadata endpoint) whose definition lacks a storage domain suffix, then hitting the naive blob-URL construction path.

Common situations: Pointing at AzureChina/Germany/USGov or a custom cloud whose environment metadata is incomplete; a misspelled environment name.

Related errors

• new container client: %v
• determining %s endpoint for %s: missing primary endpoint
• building Storage Accounts client: %+v
• retrieving key for Storage Account %q: %s
• One of `access_key`, `sas_token`, `use_azuread_auth` and `re

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/b3ff5b412d4058ea. Report an issue: GitHub.