hashicorp/terraform · error

subscription id not specified

Error message

subscription id not specified

What it means

Returned by buildClient when ARM auth is required and a subscription ID cannot be found anywhere: it is not in the backend config and the Azure CLI default subscription could not be inferred from a CachedAuthorizer/AzureCliAuthorizer. The ARM Storage Accounts client and key-listing calls all require a subscription ID.

Source

Thrown at internal/backend/remote-state/azure/api_client.go:92

	}

	if armAuthRequired {
		resourceManagerAuth, err := auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.ResourceManager)
		if err != nil {
			return nil, fmt.Errorf("unable to build authorizer for Resource Manager API: %+v", err)
		}

		// When using Azure CLI to auth, the user can leave the "subscription_id" unspecified. In this case the subscription id is inferred from
		// the Azure CLI default subscription.
		if config.SubscriptionID == "" {
			if cachedAuth, ok := resourceManagerAuth.(*auth.CachedAuthorizer); ok {
				if cliAuth, ok := cachedAuth.Source.(*auth.AzureCliAuthorizer); ok && cliAuth.DefaultSubscriptionID != "" {
					config.SubscriptionID = cliAuth.DefaultSubscriptionID
				}
			}
		}
		if config.SubscriptionID == "" {
			return nil, fmt.Errorf("subscription id not specified")
		}

		// Setup the SA client.
		client.storageAccountsClient, err = storageaccounts.NewStorageAccountsClientWithBaseURI(config.AuthConfig.Environment.ResourceManager)
		if err != nil {
			return nil, fmt.Errorf("building Storage Accounts client: %+v", err)
		}
		client.configureClient(client.storageAccountsClient.Client, resourceManagerAuth)

		// Populating the storage account detail
		storageAccountId := commonids.NewStorageAccountID(config.SubscriptionID, config.ResourceGroupName, client.storageAccountName)
		resp, err := client.storageAccountsClient.GetProperties(ctx, storageAccountId, storageaccounts.DefaultGetPropertiesOperationOptions())
		if err != nil {
			return nil, fmt.Errorf("retrieving %s: %+v", storageAccountId, err)
		}
		if resp.Model == nil {
			return nil, fmt.Errorf("retrieving %s: model was nil", storageAccountId)
		}

View on GitHub (pinned to c9def3e214)

Solutions

1. Set subscription_id in the azurerm backend block, or export ARM_SUBSCRIPTION_ID.
2. If using Azure CLI auth, run 'az account set --subscription <id>' so a default subscription is available.
3. Provide an explicit access_key or sas_token to bypass the ARM/subscribed path entirely.

Example fix

# before
export ARM_CLIENT_ID=...
export ARM_CLIENT_SECRET=...
export ARM_TENANT_ID=...
# subscription missing!
# after
export ARM_SUBSCRIPTION_ID=12345678-aaaa-bbbb-cccc-dddddddddddd

// Require a subscription id for ARM-based auth paths.
if config.AccessKey == "" && config.SasToken == "" && !config.UseAzureADAuthentication && config.SubscriptionID == "" {
    return errors.New("subscription_id (ARM_SUBSCRIPTION_ID) is required when using ARM auth")
}

When it happens

Trigger: No access key/SAS/AAD provided (so ARM auth path is taken), subscription_id omitted from the backend block and env, and either not using Azure CLI auth or the CLI has no default subscription set. Fails during client construction.

Common situations: Forgetting ARM_SUBSCRIPTION_ID in env-based auth; using service-principal auth without a subscription; 'az account set' not run so no default subscription; copy-paste config missing the subscription_id field.

Related errors

• sasToken cannot be empty
• unable to build authorizer for Storage API: %+v
• unable to build authorizer for Resource Manager API: %+v
• new shared key authorizer: %v
• argument %q is required

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/84d3913449799375. Report an issue: GitHub.