opentofu/opentofu · error

invalid storage container name: Hyphens in a storage contain

Error message

invalid storage container name: Hyphens in a storage container name must be nonconsecutive. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftstorage

What it means

Validation error from checkAccountAndContainerNames (internal/backend/remote-state/azure/backend.go). After the general container pattern passes, the name is checked against \-\- (two consecutive hyphens); Azure container names must not contain consecutive hyphens, so e.g. "prod--state" is rejected even though it satisfies the character pattern.

Source

Thrown at internal/backend/remote-state/azure/backend.go:468

		return fmt.Errorf("error getting container client: %w", err)
	}

	b.containerClient = containerClient
	return nil
}

func checkAccountAndContainerNames(storageAccount, storageContainer string) error {
	accountPattern := regexp.MustCompile(`^[0-9a-z]{3,24}$`)
	containerPattern := regexp.MustCompile(`^[0-9a-z][0-9a-z\-]{1,61}[0-9a-z]$`)
	hyphenPattern := regexp.MustCompile(`\-\-`)
	if !accountPattern.Match([]byte(storageAccount)) {
		return errors.New("invalid storage account name: Azure requires a storage account name consists of 3-24 lowercase characters and numbers only. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftstorage")
	}
	if !containerPattern.Match([]byte(storageContainer)) {
		return errors.New("invalid storage container name: Azure requires a storage container name consists of 3-63 lowercase characters, numbers, and hyphens only. It cannot start or end with a hyphen. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftstorage")
	}
	if hyphenPattern.Match([]byte(storageContainer)) {
		return errors.New("invalid storage container name: Hyphens in a storage container name must be nonconsecutive. See documentation here: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftstorage")
	}
	return nil
}

View on GitHub (pinned to 3561785c48)

Solutions

1. Remove the consecutive hyphens: use exactly one hyphen between segments
2. Fix the templating so empty segments don't collapse into '--'
3. If the container already exists, copy its real name from the Azure portal

Example fix

# before
backend "azurerm" {
  container_name = "prod--tf-state"
  ...
}

# after
backend "azurerm" {
  container_name = "prod-tf-state"
  ...
}

var doubleHyphen = regexp.MustCompile(`--`)

func validateNoConsecutiveHyphens(name string) error {
    if doubleHyphen.MatchString(name) {
        return fmt.Errorf("name %q contains consecutive hyphens", name)
    }
    return nil
}

if err := checkAccountAndContainerNames(account, container); err != nil {
    if strings.Contains(err.Error(), "nonconsecutive") {
        // collapse '--' to '-' in the generated name
    }
    return err
}

When it happens

Trigger: Setting `container_name` (or ARM_CONTAINER_NAME) that contains a double hyphen anywhere in the middle, usually produced by templating that joins two hyphen-delimited parts where one is empty.

Common situations: Name templates like "${env}-${region}-state" where env is empty; string concatenation in CI pipelines; refactors leaving stray hyphens.

Related errors

• invalid storage account name: Azure requires a storage accou
• invalid storage container name: Azure requires a storage con
• error creating credential from shared access key: %w
• error obtaining container client from access key: %w
• client certificate provided directly and through file do not

AI-assisted analysis of opentofu/opentofu@3561785c48 (2026-08-15). Data as JSON: /api/errors/4cd55129e31289e5. Report an issue: GitHub.