What causes "sasToken cannot be empty" in hashicorp/terraform?

Provide a valid, non-empty SAS token value in the backend block or ARM_SAS_TOKEN environment variable.

sasToken cannot be empty

Error message

sasToken cannot be empty

What it means

Returned by buildClient when the Azure backend is configured with a sasToken that, after whitespace trimming, is empty. The config indicated SAS auth (config.SasToken != "") but the actual token content is blank/whitespace-only, so it is rejected before use.

Source

Thrown at internal/backend/remote-state/azure/api_client.go:57

	accessKey          string
	sasToken           string
	azureAdStorageAuth auth.Authorizer
}

func buildClient(ctx context.Context, config BackendConfig) (*Client, error) {
	client := Client{
		environment:        config.AuthConfig.Environment,
		storageAccountName: config.StorageAccountName,
	}

	var armAuthRequired bool
	switch {
	case config.AccessKey != "":
		client.accessKey = config.AccessKey
	case config.SasToken != "":
		sasToken := config.SasToken
		if strings.TrimSpace(sasToken) == "" {
			return nil, fmt.Errorf("sasToken cannot be empty")
		}
		client.sasToken = strings.TrimPrefix(sasToken, "?")
	case config.UseAzureADAuthentication:
		var err error
		client.azureAdStorageAuth, err = auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.Storage)
		if err != nil {
			return nil, fmt.Errorf("unable to build authorizer for Storage API: %+v", err)
		}
	default:
		// AAD authentication (ARM scope) is required only when no auth method is specified, which falls back to listing the access key via ARM API.
		armAuthRequired = true
	}

	// If `config.LookupBlobEndpoint` is true, we need to authenticate with ARM to lookup the blob endpoint
	if config.LookupBlobEndpoint {
		armAuthRequired = true
	}

View on GitHub (pinned to c9def3e214)

Solutions

Provide a valid, non-empty SAS token value in the backend block or ARM_SAS_TOKEN environment variable.
Verify the CI/CD secret actually populates ARM_SAS_TOKEN (print its length, not its value).
Strip only a leading '?' if present; ensure the remaining token has content.

Example fix

# before
export ARM_SAS_TOKEN=""
# after
export ARM_SAS_TOKEN="sv=2021-06-08&ss=bfqt&srt=sco..."

Defensive patterns

Strategy: validation

Validate before calling

sas := strings.TrimSpace(config.SasToken)
if config.SasToken != "" && sas == "" {
    return errors.New("sas_token is set but empty after trimming; provide a real SAS token")
}

Prevention

Validate that ARM_SAS_TOKEN is populated (check length, not value) in CI before terraform init.
Store the SAS token in a secret manager rather than hardcoding possibly-empty values.
Use a config linter that rejects whitespace-only secret values.

When it happens

Trigger: Setting sas_token in the azurerm backend block (or ARM_SAS_TOKEN env var) to an empty string or whitespace while the non-empty check passed due to leading characters. Most directly: config.SasToken is non-empty but strings.TrimSpace yields empty.

Common situations: ARM_SAS_TOKEN env var set to spaces/quotes only; sas_token = "" with accidental characters; CI secret not populated resulting in a blank value; copy-paste of the key with only the leading '?' or quotes stripped.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/5cf23ec9d975fe39. Report an issue: GitHub.