Diagnose: Terraform azurerm backend: state lock held or backend auth failed
Symptom: Terraform azurerm backend: state lock held or backend auth failed Cause: Two flavors: 'Error acquiring the state lock' (a previous apply crashed or is still running) and backend auth failures (the backend block authenticates separately from the provider). Not for different error messages.
TL;DR: Symptom: Terraform azurerm backend: state lock held or backend auth failed Cause: Two flavors: 'Error acquiring the state lock' (a previous apply crashed or is still running) and backend auth failures (the backend block authenticates separately from the provider). CONFIRM IT CONFIRM: lock error names the lock ID and who holds it - check whether that apply is actually still running before force-unlocking. FIX FIX: lock genuinely orphaned: terraform force-unlock [id] (only when sure nothing is running).
The error
Error acquiring the state lockThe fix
SYMPTOM Terraform azurerm backend: state lock held or backend auth failed
CAUSE Two flavors: 'Error acquiring the state lock' (a previous apply crashed or is still running) and backend auth failures (the backend block authenticates separately from the provider).
CONFIRM IT CONFIRM: lock error names the lock ID and who holds it - check whether that apply is actually still running before force-unlocking. Backend auth failure happens at terraform init, provider auth failure at plan: the stage tells you which block is misconfigured.
FIX FIX: lock genuinely orphaned: terraform force-unlock [id] (only when sure nothing is running). Backend auth: give the backend the same ARM_ env vars / OIDC as the provider, or a valid SAS for the state blob. Never delete the state blob to clear a lock.
VERIFY VERIFY: terraform init then plan runs clean with no lock error; state blob lease is free.
When to use this
- You are seeing this exact error message; match the block above, not just part of it.
- The failing call matches the scenario in the title: Diagnose.
- You want the fastest verified fix before digging through logs.
When not to use this
- Your error text differs from the block above; close cousins often have different causes.
- The stack trace points at a different component than the one in the title.
- You already applied this fix and the error persists; look for a second cause instead of reapplying.
Compatibility
- Not pinned to a specific version; follows current Diagnose behavior.