Fix Azure China Authentication Errors in Terraform: A Step‑by‑Step Guide

After a period of not using Terraform for Azure, the author revisits Azure Provider authentication and encounters issues.

Terraform requires Azure credentials; the Azure Provider supports four authentication methods. The article focuses on the fourth method: authenticating using a Service Principal with a Client Secret.

First, create a Service Principal in Azure (see official docs). Then configure provider.tf with subscription_id, client_id, client_secret, tenant_id, and optionally version.

provider "azurerm" {
  version = "=2.4.0"
  subscription_id = "00000000-0000-0000-0000-000000000000"
  client_id       = "00000000-0000-0000-0000-000000000000"
  client_secret   = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  tenant_id       = "00000000-0000-0000-0000-000000000000"
  features {}
}

The main.tf defines a resource group:

resource "azurerm_resource_group" "azure-tf-rg" {
  name     = "terraform-eval"
  location = "chinaeast2"
  tags = {
    env      = "dev"
    location = "China East2"
  }
}

Running terraform init succeeds, but terraform plan fails with an authentication error because the default environment points to the public Azure cloud, while the Service Principal was created in Azure China.

Adding environment = "china" to the provider block resolves the issue.

provider "azurerm" {
  version       = "=2.4.0"
  environment   = "china"
  subscription_id = "00000000-0000-0000-0000-000000000000"
  client_id       = "00000000-0000-0000-0000-000000000000"
  client_secret   = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  tenant_id       = "00000000-0000-0000-0000-000000000000"
  features {}
}

After the change, terraform plan shows one resource to add, and terraform apply creates the resource group successfully.

This issue only appears when using Azure China, US Government, or Germany clouds; the public Azure cloud does not exhibit it.