How to use Azurite as a terraform azurerm backend? Should it be possible?

[rgl]

How to use Azurite as a terraform azurerm backend (which from what I can tell uses Blob storage)? that is, what to put in the backend bellow?

terraform {
  required_version = "1.12.2"
  backend "azurerm" {
    # TODO any idea of what to put here and/or in terraform invocation or environment variables?
    resource_group_name  = "terraform"
    storage_account_name = "devstoreaccount1"
    container_name       = "terraform"
    key                  = "playground.terraform.tfstate"
    use_azuread_auth     = false
    use_msi              = false
  }
}

[blueww]

@rgl

Azurite is a storage dataplane (blob/queue/table) API emulator.
From your configure of terraform , there are "resource_group_name", so I suspect it use the management plane Storage API, which is not support by azurite. So this should not work in Azurite.
Storage dataplane and management API are very different , they have different endpoint/Url, different credential, the API header/body are also different.
You might can contact the team who owns terraform azurerm to see is it possible to only use storage dataplan API. If not, Azurite can't support it.

[rgl]

Thank You! That pointed me to the correct direction... I think!

The documentation at https://developer.hashicorp.com/terraform/language/backend/azurerm#access-key mentions:

The Access Key is then used to directly authenticate to the storage account data plane.

Which seems to infer, terraform would directly connect to the data plane?

And the only thing missing seems to be a way to set custom endpoint to point to the local Azurite endpoint?

[blueww]

The default Azurite endpoint and account sharedkey can be found in https://github.com/Azure/Azurite#http-connection-strings.

However, from this doc, not see a way to set custom endpoint. You might can contact the team who owns terraform azurerm to see how to do it.

[rgl]

I've modified terraform to allow setting the blob endpoint at https://github.com/rgl/terraform/tree/rgl-azurite, and created a playground at https://github.com/rgl/terraform-remote-state-azurerm-azurite-playground/tree/wip.

But for some reason terraform errors out with an azurite authentication failure:

2025-07-08T07:51:28.639Z [DEBUG] GET http://storage:10000/devstoreaccount1/terraform?comp=list&prefix=playground.terraform.tfstateenv%3A&restype=container
│ Error: Failed to get existing workspaces: listing blobs: executing request:
 unexpected status 403 (403 Server failed to authenticate the request. Make sure the value of the
Authorization header is formed correctly including the signature.) with AuthorizationFailure:
 Server failed to authenticate the request.
 Make sure the value of the Authorization header is formed correctly including the signature.
│ RequestId:57ab73e2-7079-497e-a18d-818718c0dc05
│ Time:2025-07-08T07:51:28.643Z

And azurite logs (I've formatted them for easier reading):

2025-07-08T07:51:28.641Z 57ab73e2-7079-497e-a18d-818718c0dc05 info: BlobStorageContextMiddleware:
RequestMethod=GET
RequestURL=http://storage/devstoreaccount1/terraform?comp=list&prefix=playground.terraform.tfstateenv%3A&restype=container 
RequestHeaders:{
"host":"storage:10000",
"user-agent":"HashiCorp/go-azure-sdk (Go-http-Client/1.1 storage/blob/containers/2023-11-03) HashiCorp Terraform/1.12.2 (+https://www.terraform.io)",
"authorization":"SharedKey devstoreaccount1:3ShBxi957/+Q8uuOKK8pvyAUSfoQI7j0oq51yU+Goeg=",
"content-type":"application/xml; charset=utf-8",
"x-ms-date":"Tue, 08 Jul 2025 07:51:28 GMT",
"x-ms-version":"2023-11-03",
"accept-encoding":"gzip"}
ClientIP=172.19.0.3
Protocol=http
HTTPVersion=1.1
...
2025-07-08T07:51:28.644Z 57ab73e2-7079-497e-a18d-818718c0dc05
error: 
ErrorMiddleware: ErrorName=StorageError
ErrorMessage=Server failed to authenticate the request. Make sure the value of the Authorization header is formed correctly including the signature.
ErrorHTTPStatusCode=403
ErrorHTTPStatusMessage=Server failed to authenticate the request. Make sure the value of the Authorization header is formed correctly including the signature.
ErrorHTTPHeaders={
 "x-ms-error-code":"AuthorizationFailure",
 "x-ms-request-id":"57ab73e2-7079-497e-a18d-818718c0dc05"}
ErrorHTTPBody="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n
<Error>\n  
  <Code>AuthorizationFailure</Code>\n  
  <Message>Server failed to authenticate the request. Make sure the value of the Authorization header is formed correctly including the signature.\n
   RequestId:57ab73e2-7079-497e-a18d-818718c0dc05\n
   Time:2025-07-08T07:51:28.643Z
  </Message>\n
</Error>"
ErrorStack="StorageError: Server failed to authenticate the request. Make sure the value of the Authorization header is formed correctly including the signature.\n   
at StorageErrorFactory.getAuthorizationFailure (/opt/azurite/dist/src/blob/errors/StorageErrorFactory.js:144:16)\n    
at /opt/azurite/dist/src/blob/middlewares/AuthenticationMiddlewareFactory.js:25:56\n    
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)"
...

Please see the full details in the playground README.md which also contains the instructions to reproduce this.

[blueww]

It looks the stringToSign is not correct.

Would you like try to run Azurite with parameter "--disableProductStyleUrl" and see if the issue can be resolved?
See details in https://github.com/Azure/Azurite#:~:text=start%20Azurite%20with-,%2D%2DdisableProductStyleUrl,-.

[rgl]

Indeed, terraform seems to be generating a bogus signature. It all started to work after I've modified the azurite BlobSharedKeyAuthenticator.validate method to always return true, so it actually ignores the signature and allows anything; after that, terraform seems to work fine. So further digging is required, I guess.

Using --disableProductStyleUrl did not fix the signature problem.