{"record":{"id":"0b1b6ae0e747ebc5","repo":"hashicorp/terraform","slug":"refresh-ecs-sts-token-err-fail-to-get-securitytok","errorCode":null,"errorMessage":"refresh Ecs sts token err, fail to get SecurityToken: %s","messagePattern":"refresh Ecs sts token err, fail to get SecurityToken: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":700,"sourceCode":"\t\treturn\n\t}\n\tif code.(string) != \"Success\" {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, Code is not Success\")\n\t\treturn\n\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeyId: %s\", err.Error())\n\t\treturn\n\t}\n\taccessKeySecret, err := jmespath.Search(\"AccessKeySecret\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeySecret: %s\", err.Error())\n\t\treturn\n\t}\n\tsecurityToken, err := jmespath.Search(\"SecurityToken\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get SecurityToken: %s\", err.Error())\n\t\treturn\n\t}\n\n\tif accessKeyId == nil || accessKeySecret == nil || securityToken == nil {\n\t\terr = fmt.Errorf(\"there is no any available accesskey, secret and security token for Ecs role %s\", ecsRoleName)\n\t\treturn\n\t}\n\n\treturn accessKeyId.(string), accessKeySecret.(string), securityToken.(string), nil\n}\n\nfunc getHttpProxyUrl(rawUrl string) (*url.URL, error) {\n\tpc := httpproxy.FromEnvironment()\n\tu, err := url.Parse(rawUrl)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn pc.ProxyFunc()(u)","sourceCodeStart":682,"sourceCodeEnd":718,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L682-L718","documentation":"Same getAuthCredentialByEcsRoleName path (backend.go:644), but here the JMESPath lookup for SecurityToken failed after AccessKeySecret succeeded. The STS bearer token is the third credential component returned by the metadata service; without it the OSS SDK cannot sign temporary-credential requests. It indicates the metadata JSON is well-formed enough to find the secret but missing/malformed the SecurityToken value.","triggerScenarios":"JMESPath Search(\"SecurityToken\", data) returns an error while processing the STS JSON from the instance metadata endpoint. Occurs when the response has AccessKeyId/AccessKeySecret but the SecurityToken field is absent, null in a non-string form, or the JSON shape differs from the documented response.","commonSituations":"A RAM role policy that issues long-lived keys rather than STS tokens; metadata response from a custom/legacy role; regional metadata service degradation returning partial tokens; running on a non-ECS host with a hand-crafted metadata stub.","solutions":["Inspect the raw metadata JSON and confirm a non-empty SecurityToken field exists.","Ensure the RAM role is configured for STS/temporary credential issuance rather than static key material.","Fall back to an explicit profile or access_key/secret_key in the backend block to avoid the metadata STS path.","Re-grant/replace the RAM role on the ECS instance so a full STS triple is issued."],"exampleFix":"// before\nbackend \"oss\" {\n  bucket = \"tf-state\"\n  ecs_role_name = \"stale-role\"\n}\n\n// after\nbackend \"oss\" {\n  bucket = \"tf-state\"\n  access_key = var.ali_key\n  secret_key = var.ali_secret\n}","handlingStrategy":"validation","validationCode":"// Extend the checkSTS helper from error 340 to also assert SecurityToken.\nif v, err := jmespath.Search(\"SecurityToken\", data); err != nil || v == nil || v == \"\" {\n    return fmt.Errorf(\"SecurityToken missing/empty in STS response\")\n}","typeGuard":null,"tryCatchPattern":"// Fatal: do not retry. If you invoke the backend programmatically:\nif err != nil && strings.Contains(err.Error(), \"fail to get SecurityToken\") {\n    log.Fatal(\"STS metadata malformed; switch backend auth to a profile or AK/SK\")\n}","preventionTips":["Confirm the RAM role issues STS tokens (temporary credentials), not long-lived keys.","Re-fetch the metadata JSON after reattaching the role to flush a partial response.","Avoid hand-mocked metadata servers in non-ECS test environments."],"tags":["alibaba-cloud","oss","ecs-sts","authentication","metadata-service","go"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}