subcategory	Storage
layout	azurerm
page_title	Azure Resource Manager: azurerm_storage_account
description	Manages a Azure Storage Account.

azurerm_storage_account

Manages an Azure Storage Account.

Example Usage

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_storage_account" "example" {
  name                     = "storageaccountname"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "GRS"

  tags = {
    environment = "staging"
  }
}

Example Usage with Network Rules

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_virtual_network" "example" {
  name                = "virtnetname"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example" {
  name                 = "subnetname"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.2.0/24"]
  service_endpoints    = ["Microsoft.Sql", "Microsoft.Storage"]
}

resource "azurerm_storage_account" "example" {
  name                = "storageaccountname"
  resource_group_name = azurerm_resource_group.example.name

  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  network_rules {
    default_action             = "Deny"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
  }

  tags = {
    environment = "staging"
  }
}

Arguments Reference

The following arguments are supported:

name - (Required) Specifies the name of the storage account. Only lowercase Alphanumeric characters allowed. Changing this forces a new resource to be created. This must be unique across the entire Azure service, not just within the resource group.
resource_group_name - (Required) The name of the resource group in which to create the storage account. Changing this forces a new resource to be created.
location - (Required) Specifies the supported Azure location where the resource exists. Changing this forces a new resource to be created.
account_kind - (Optional) Defines the Kind of account. Valid options are BlobStorage, BlockBlobStorage, FileStorage, Storage and StorageV2. Defaults to StorageV2.

-> Note: Changing the account_kind value from Storage to StorageV2 will not trigger a force new on the storage account, it will only upgrade the existing storage account from Storage to StorageV2 keeping the existing storage account in place.

account_tier - (Required) Defines the Tier to use for this storage account. Valid options are Standard and Premium. For BlockBlobStorage and FileStorage accounts only Premium is valid. Changing this forces a new resource to be created.

-> Note: Blobs with a tier of Premium are of account kind StorageV2.

account_replication_type - (Required) Defines the type of replication to use for this storage account. Valid options are LRS, GRS, RAGRS, ZRS, GZRS and RAGZRS. Changing this forces a new resource to be created when types LRS, GRS and RAGRS are changed to ZRS, GZRS or RAGZRS and vice versa.
provisioned_billing_model_version - (Optional) Specifies the version of the provisioned billing model (e.g. when account_kind = "FileStorage" for Storage File). Possible value is V2. Changing this forces a new resource to be created.
cross_tenant_replication_enabled - (Optional) Should cross Tenant replication be enabled? Defaults to false.
access_tier - (Optional) Defines the access tier for BlobStorage, FileStorage and StorageV2 accounts. Valid options are Hot, Cool, Cold and Premium. Defaults to Hot.
edge_zone - (Optional) Specifies the Edge Zone within the Azure Region where this Storage Account should exist. Changing this forces a new Storage Account to be created.
https_traffic_only_enabled - (Optional) Boolean flag which forces HTTPS if enabled, see here for more information. Defaults to true.
min_tls_version - (Optional) The minimum supported TLS version for the storage account. Possible values are TLS1_0, TLS1_1 and TLS1_2. Defaults to TLS1_2 for new storage accounts.

~> Note: Azure Services will require TLS 1.2+ by August 2025, please see this announcement for more.

-> Note: At this time min_tls_version is only supported in the Public Cloud, China Cloud, and US Government Cloud.

allow_nested_items_to_be_public - (Optional) Allow or disallow nested items within this Account to opt into being public. Defaults to true.

-> Note: At this time allow_nested_items_to_be_public is only supported in the Public Cloud, China Cloud, and US Government Cloud.

shared_access_key_enabled - (Optional) Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). Defaults to true.

~> Note: Terraform uses Shared Key Authorisation to provision Storage Containers, Blobs and other items - when Shared Key Access is disabled, you will need to enable the storage_use_azuread flag in the Provider block to use Azure AD for authentication, however not all Azure Storage services support Active Directory authentication.

public_network_access_enabled - (Optional) Whether the public network access is enabled? Defaults to true.
default_to_oauth_authentication - (Optional) Default to Azure Active Directory authorization in the Azure portal when accessing the Storage Account. The default value is false
is_hns_enabled - (Optional) Is Hierarchical Namespace enabled? This can be used with Azure Data Lake Storage Gen 2 (see here for more information). Changing this forces a new resource to be created.

-> Note: This can only be true when account_tier is Standard or when account_tier is Premium and account_kind is BlockBlobStorage

nfsv3_enabled - (Optional) Is NFSv3 protocol enabled? Changing this forces a new resource to be created. Defaults to false.

-> Note: This can only be true when account_tier is Standard and account_kind is StorageV2, or account_tier is Premium and account_kind is BlockBlobStorage. Additionally, the is_hns_enabled is true and account_replication_type must be LRS or RAGRS.

custom_domain - (Optional) A custom_domain block as documented below.
customer_managed_key - (Optional) A customer_managed_key block as documented below.

~> Note: It's possible to define a Customer Managed Key both within either the customer_managed_key block or by using the azurerm_storage_account_customer_managed_key resource. However, it's not possible to use both methods to manage a Customer Managed Key for a Storage Account, since these will conflict. When using the azurerm_storage_account_customer_managed_key resource, you will need to use ignore_changes on the customer_managed_key block.

identity - (Optional) An identity block as defined below.
blob_properties - (Optional) A blob_properties block as defined below.
queue_properties - (Optional) A queue_properties block as defined below.

~> Note: queue_properties can only be configured when account_tier is set to Standard and account_kind is set to either Storage or StorageV2.

static_website - (Optional) A static_website block as defined below.

~> Note: static_website can only be set when the account_kind is set to StorageV2 or BlockBlobStorage.

~> Note: If static_website is specified, the service will automatically create a azurerm_storage_container named $web.

share_properties - (Optional) A share_properties block as defined below.

~> Note: share_properties can only be configured when either account_tier is Standard and account_kind is either Storage or StorageV2 - or when account_tier is Premium and account_kind is FileStorage.

network_rules - (Optional) A network_rules block as documented below.
large_file_share_enabled - (Optional) Are Large File Shares Enabled? Defaults to false.

-> Note: Large File Shares are enabled by default when using an account_kind of FileStorage.

local_user_enabled - (Optional) Is Local User Enabled? Defaults to true.
azure_files_authentication - (Optional) A azure_files_authentication block as defined below.
routing - (Optional) A routing block as defined below.
queue_encryption_key_type - (Optional) The encryption type of the queue service. Possible values are Service and Account. Changing this forces a new resource to be created. Default value is Service.
table_encryption_key_type - (Optional) The encryption type of the table service. Possible values are Service and Account. Changing this forces a new resource to be created. Default value is Service.

~> Note: queue_encryption_key_type and table_encryption_key_type cannot be set to Account when account_kind is set Storage

infrastructure_encryption_enabled - (Optional) Is infrastructure encryption enabled? Changing this forces a new resource to be created. Defaults to false.

-> Note: This can only be true when account_kind is StorageV2 or when account_tier is Premium and account_kind is one of BlockBlobStorage or FileStorage.

immutability_policy - (Optional) An immutability_policy block as defined below. Changing this forces a new resource to be created.
sas_policy - (Optional) A sas_policy block as defined below.
allowed_copy_scope - (Optional) Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet. Possible values are AAD and PrivateLink.
sftp_enabled - (Optional) Boolean, enable SFTP for the storage account

-> Note: SFTP support requires is_hns_enabled set to true. More information on SFTP support can be found here. Defaults to false

dns_endpoint_type - (Optional) Specifies which DNS endpoint type to use. Possible values are Standard and AzureDnsZone. Defaults to Standard. Changing this forces a new resource to be created.

-> Note: Azure DNS zone support requires PartitionedDns feature to be enabled. To enable this feature for your subscription, use the following command: az feature register --namespace "Microsoft.Storage" --name "PartitionedDns".

tags - (Optional) A mapping of tags to assign to the resource.

A blob_properties block supports the following:

cors_rule - (Optional) A cors_rule block as defined below.
delete_retention_policy - (Optional) A delete_retention_policy block as defined below.
restore_policy - (Optional) A restore_policy block as defined below. This must be used together with delete_retention_policy set, versioning_enabled and change_feed_enabled set to true.