Azure storage account ID is not set; it is required to rende

Error message

Azure storage account ID is not set; it is required to render blob %q

What it means

The TerraformWriter requires AzureStorageAccountID to be populated before it can render an azurerm_storage_blob; it is used to compose the StorageContainerID (account + blobServices/default/containers/<name>). If the writer's AzureStorageAccountID field is empty, RenderTerraform aborts with this error naming the blob path.

Source

Thrown at util/pkg/vfs/azureblob_terraform.go:46

	StorageContainerID string                   `cty:"storage_container_id"`
	Type               string                   `cty:"type"`
	Source             *terraformWriter.Literal `cty:"source"`
	Provider           *terraformWriter.Literal `cty:"provider"`
}

func (p *AzureBlobPath) RenderTerraform(w *terraformWriter.TerraformWriter, name string, data io.Reader, acl ACL) error {
	bytes, err := io.ReadAll(data)
	if err != nil {
		return fmt.Errorf("reading data: %w", err)
	}

	w.EnsureTerraformProvider("azurerm", map[string]string{})

	if p.account == "" {
		return fmt.Errorf("Azure storage account is not set on path %q", p.Path())
	}
	if w.AzureStorageAccountID == "" {
		return fmt.Errorf("Azure storage account ID is not set; it is required to render blob %q", p.Path())
	}

	source, err := w.AddFilePath("azurerm_storage_blob", name, "source", bytes, false)
	if err != nil {
		return fmt.Errorf("rendering Azure Blob file: %w", err)
	}

	tf := &terraformAzureBlobFile{
		Name:               p.key,
		StorageContainerID: w.AzureStorageAccountID + "/blobServices/default/containers/" + p.container,
		Type:               "Block",
		Source:             source,
		Provider:           terraformWriter.LiteralTokens("azurerm", "files"),
	}
	return w.RenderResource("azurerm_storage_blob", name, tf)
}

View on GitHub (pinned to 4c8573c808)

Solutions

Set w.AzureStorageAccountID to the Azure resource ID of the storage account before calling RenderTerraform
Ensure the kops Azure target populates AzureStorageAccountID (check target setup for the azurerm provider)
Verify the cluster spec's Azure storage account is defined so its ID can be resolved from Azure
Re-run the terraform render after the writer is properly initialized

Example fix

// before
w := terraformWriter.NewTerraformWriter()
p.RenderTerraform(w, name, data, acl)

// after
w := terraformWriter.NewTerraformWriter()
w.AzureStorageAccountID = "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<account>"
if w.AzureStorageAccountID == "" {
	return fmt.Errorf("cannot render blob: storage account ID unknown")
}
return p.RenderTerraform(w, name, data, acl)

Defensive patterns

Strategy: validation

Validate before calling

if w.AzureStorageAccountID == "" {
	return fmt.Errorf("TerraformWriter.AzureStorageAccountID must be set to the account's Azure resource ID before rendering blobs")
}

Try / catch

if err := p.RenderTerraform(w, name, data, acl); err != nil {
	if strings.Contains(err.Error(), "storage account ID is not set") {
		return fmt.Errorf("initialize the Azure target so AzureStorageAccountID is populated: %w", err)
	}
	return err
}

Prevention

Always construct the TerraformWriter through the kops Azure target setup, which assigns AzureStorageAccountID
Assert AzureStorageAccountID is non-empty in tests before rendering Azure blob resources
Keep the cluster's Azure storage account resource ID resolvable from the subscription config

When it happens

Trigger: RenderTerraform called with a TerraformWriter whose AzureStorageAccountID was never set — typically because the writer was created by a code path that only populates it for Azure targets, or the cluster's Azure storage account/ID could not be resolved before rendering.

Common situations: Using kOps' terraform writer directly or via a non-Azure target that skipped Azure setup; cluster config lacks the Azure storage account ID; upgrading kOps versions where Azure writer initialization (EnsureTerraformProvider / Azure target setup) changed and ID assignment was skipped.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7b87329da7a61617. Report an issue: GitHub.