hashicorp/terraform · error

One of `access_key`, `sas_token`, `use_azuread_auth` and `re

Error message

One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified

What it means

A hard configuration-validation error raised in Backend.Configure (backend.go:453-456). When resource_group_name is empty AND the backend would need to look up an access key via ARM (i.e. access_key, sas_token, and use_azuread_auth are all unset), Terraform cannot form the storage-account resource ID needed for the ListKeys call. Configure aborts before any network call.

Source

Thrown at internal/backend/remote-state/azure/backend.go:456

		EnableAuthenticationUsingGitHubOIDC:        enableOidc,
		EnableAuthenticationUsingADOPipelineOIDC:   enableOidc,
	}

	backendConfig := BackendConfig{
		AuthConfig:               authConfig,
		SubscriptionID:           data.String("subscription_id"),
		ResourceGroupName:        data.String("resource_group_name"),
		StorageAccountName:       data.String("storage_account_name"),
		LookupBlobEndpoint:       data.Bool("lookup_blob_endpoint"),
		AccessKey:                data.String("access_key"),
		SasToken:                 data.String("sas_token"),
		UseAzureADAuthentication: data.Bool("use_azuread_auth"),
	}

	needToLookupAccessKey := backendConfig.AccessKey == "" && backendConfig.SasToken == "" && !backendConfig.UseAzureADAuthentication
	if backendConfig.ResourceGroupName == "" {
		if needToLookupAccessKey {
			return backendbase.ErrorAsDiagnostics(fmt.Errorf("One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified"))
		}
		if backendConfig.LookupBlobEndpoint {
			return backendbase.ErrorAsDiagnostics(fmt.Errorf("`resource_group_name` is required when `lookup_blob_endpoint` is set"))
		}
	}

	client, err := buildClient(ctx, backendConfig)
	if err != nil {
		return backendbase.ErrorAsDiagnostics(err)
	}

	b.apiClient = client
	return nil
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Add resource_group_name (and subscription_id) to the backend block so ListKeys can run
2. Or set access_key, sas_token, or use_azuread_auth = true so key lookup is not required
3. If using env vars, export ARM_RESOURCE_GROUP_NAME / ARM_ACCESS_KEY / ARM_USE_AZUREAD=true as appropriate

Example fix

// before: no auth method, no resource group -> Configure fails
terraform {
  backend "azurerm" {
    storage_account_name = "mystage"
    container_name       = "tfstate"
    key                  = "prod.tfstate"
  }
}

// after: add resource_group_name so ARM key lookup can proceed
terraform {
  backend "azurerm" {
    resource_group_name  = "rg-tfstate"
    storage_account_name = "mystage"
    container_name       = "tfstate"
    key                  = "prod.tfstate"
    subscription_id      = "00000000-0000-0000-0000-000000000000"
  }
}

# Enforce that at least one auth path is satisfiable before terraform init
HAS_RG="${ARM_RESOURCE_GROUP_NAME:+yes}"
HAS_KEY="${ARM_ACCESS_KEY:+yes}"
HAS_SAS="${ARM_SAS_TOKEN:+yes}"
HAS_AAD="${ARM_USE_AZUREAD:+yes}"
if [ "$HAS_RG" != yes ] && [ "$HAS_KEY$HAS_SAS$HAS_AAD" = "" ]; then
  echo "FAIL: set resource_group_name OR access_key/sas_token/use_azuread_auth (error 146)"
  exit 1
fi
echo "OK: auth path available"

When it happens

Trigger: Produced at backend.go:454-456 when needToLookupAccessKey is true (no access_key, no sas_token, use_azuread_auth false) and backendConfig.ResourceGroupName == "". Happens at 'terraform init' once the backend block is parsed.

Common situations: Removing a previously-set access_key (e.g. after a key rotation) without adding resource_group_name; a backend block copy-pasted with only storage_account_name/container_name/key; relying purely on CLI auth but forgetting the resource group.

Related errors

• `resource_group_name` is required when `lookup_blob_endpoint
• could not decode client certificate data: %v
• the secret name %v is invalid, {validationErrors} This is a
• retrieving key for Storage Account %q: %s
• new container client: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/bdc065fbbea7b5e1. Report an issue: GitHub.