hashicorp/terraform · error

`resource_group_name` is required when `lookup_blob_endpoint

Error message

`resource_group_name` is required when `lookup_blob_endpoint` is set

What it means

A configuration-validation error in Backend.Configure (backend.go:458-460). The lookup_blob_endpoint option tells the backend to query ARM for the storage account's real primary blob endpoint (required for Azure DNS zone / private-endpoint endpoints). That ARM lookup needs resource_group_name to build the storage-account resource ID; without it the lookup is impossible, so Configure refuses.

Source

Thrown at internal/backend/remote-state/azure/backend.go:459

	backendConfig := BackendConfig{
		AuthConfig:               authConfig,
		SubscriptionID:           data.String("subscription_id"),
		ResourceGroupName:        data.String("resource_group_name"),
		StorageAccountName:       data.String("storage_account_name"),
		LookupBlobEndpoint:       data.Bool("lookup_blob_endpoint"),
		AccessKey:                data.String("access_key"),
		SasToken:                 data.String("sas_token"),
		UseAzureADAuthentication: data.Bool("use_azuread_auth"),
	}

	needToLookupAccessKey := backendConfig.AccessKey == "" && backendConfig.SasToken == "" && !backendConfig.UseAzureADAuthentication
	if backendConfig.ResourceGroupName == "" {
		if needToLookupAccessKey {
			return backendbase.ErrorAsDiagnostics(fmt.Errorf("One of `access_key`, `sas_token`, `use_azuread_auth` and `resource_group_name` must be specified"))
		}
		if backendConfig.LookupBlobEndpoint {
			return backendbase.ErrorAsDiagnostics(fmt.Errorf("`resource_group_name` is required when `lookup_blob_endpoint` is set"))
		}
	}

	client, err := buildClient(ctx, backendConfig)
	if err != nil {
		return backendbase.ErrorAsDiagnostics(err)
	}

	b.apiClient = client
	return nil
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Add resource_group_name to the backend block
2. Or disable lookup_blob_endpoint if your account uses the standard public blob endpoint
3. Check that ARM_USE_DNS_ZONE_ENDPOINT env var is not unintentionally set to true

Example fix

// before: lookup enabled but no resource group
terraform {
  backend "azurerm" {
    storage_account_name  = "mystage"
    container_name        = "tfstate"
    key                   = "prod.tfstate"
    lookup_blob_endpoint  = true
  }
}

// after: provide resource_group_name (and subscription_id)
terraform {
  backend "azurerm" {
    resource_group_name   = "rg-tfstate"
    storage_account_name  = "mystage"
    container_name        = "tfstate"
    key                   = "prod.tfstate"
    lookup_blob_endpoint  = true
    subscription_id       = "00000000-0000-0000-0000-000000000000"
  }
}

# When lookup_blob_endpoint is enabled, require resource_group_name
LOOKUP="${ARM_USE_DNS_ZONE_ENDPOINT:-false}"
if [ "$LOOKUP" = true ] || [ "$LOOKUP" = 1 ]; then
  [ -n "$ARM_RESOURCE_GROUP_NAME" ] && echo "OK" || { echo "FAIL: resource_group_name required with lookup_blob_endpoint (error 147)"; exit 1; }
fi

When it happens

Trigger: Produced at backend.go:458-459 when LookupBlobEndpoint is true and resource_group_name is empty. Triggered at 'terraform init' before any data-plane call.

Common situations: Enabling lookup_blob_endpoint (often set via ARM_USE_DNS_ZONE_ENDPOINT=true) for a storage account behind a private DNS zone but forgetting to set resource_group_name; an environment variable enabling the flag globally.

Related errors

• new container client: %v
• One of `access_key`, `sas_token`, `use_azuread_auth` and `re
• the secret name %v is invalid, {validationErrors} This is a
• populating details for %s: %+v
• can't delete default state

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/25d09300dc159c03. Report an issue: GitHub.