What causes "unable to determine the Write Key for %s" in hashicorp/terraform?

Regenerate the storage account keys then retry: `az storage account keys renew`.

unable to determine the Write Key for %s

Error message

unable to determine the Write Key for %s

What it means

After ListKeys succeeds, AccountKey (storage_client_helpers.go:83) scans the returned keys for one whose Permissions equals KeyPermissionFull and whose Value is non-nil. If none qualifies (keys empty, all permissions nil, or only restricted keys), it cannot pick a usable write key and fails.

Source

Thrown at internal/backend/remote-state/azure/storage_client_helpers.go:83

	if err != nil {
		return nil, fmt.Errorf("listing Keys for %s: %+v", ad.StorageAccountId, err)
	}

	if model := listKeysResp.Model; model != nil && model.Keys != nil {
		for _, key := range *model.Keys {
			if key.Permissions == nil || key.Value == nil {
				continue
			}

			if *key.Permissions == storageaccounts.KeyPermissionFull {
				ad.accountKey = key.Value
				break
			}
		}
	}

	if ad.accountKey == nil {
		return nil, fmt.Errorf("unable to determine the Write Key for %s", ad.StorageAccountId)
	}

	return ad.accountKey, nil
}

func (ad *AccountDetails) DataPlaneEndpoint(endpointType EndpointType) (*string, error) {
	var baseUri *string
	switch endpointType {
	case EndpointTypeBlob:
		baseUri = ad.primaryBlobEndpoint

	case EndpointTypeDfs:
		baseUri = ad.primaryDfsEndpoint

	case EndpointTypeFile:
		baseUri = ad.primaryFileEndpoint

	case EndpointTypeQueue:

View on GitHub (pinned to c9def3e214)

Solutions

Regenerate the storage account keys then retry: `az storage account keys renew`.
Confirm the account is healthy and not mid-rotation.
Use a different backend auth mode (SAS, managed identity) instead of access keys.
Verify the go-azure-sdk storageaccounts API version matches the cloud's response shape.

Defensive patterns

Strategy: validation

Validate before calling

# confirm at least one Full-permission key exists
az storage account keys list \
  --account-name <acct> --resource-group <rg> \
  --query "[?permissions=='Full'].value | length(@)" --output tsv | grep -qv '^0$' \
  || echo "WARN: no Full-permission storage key available"

Type guard

// verify the ListKeys model contains a usable Full key
func hasFullKey(model *storageaccounts.ListKeysResult) bool {
    if model == nil || model.Keys == nil {
        return false
    }
    for _, k := range *model.Keys {
        if k.Permissions != nil && *k.Permissions == storageaccounts.KeyPermissionFull && k.Value != nil {
            return true
        }
    }
    return false
}

Prevention

Avoid mid-rotation when running terraform; complete key renewal first.
Prefer SAS or managed-identity backend auth to avoid key dependence.
Monitor storage account health before runs.

When it happens

Trigger: ListKeys returns a model with no keys, keys whose Value/Permissions are nil, or only non-Full keys, so the loop at storage_client_helpers.go:69-79 never sets accountKey.

Common situations: Account in a degraded or mid-rotation key state; partial ListKeys response; API-version skew returning an unexpected key shape; key retrieval returning empty for a misconfigured account.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/40313671d87d1553. Report an issue: GitHub.