{"record":{"id":"29779c6ff26f42c0","repo":"hashicorp/terraform","slug":"failed-to-access-object-httpstatuscode-d-opcrequ","errorCode":null,"errorMessage":"failed to access object HttpStatusCode: %d\nOpcRequestId: %s\n message: %s\n ErrorCode: %s","messagePattern":"failed to access object HttpStatusCode: (.+?)\nOpcRequestId: (.+?)\n message: (.+?)\n ErrorCode: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/client.go","lineNumber":97,"sourceCode":"\t\tNamespaceName: common.String(c.namespace),\n\t\tObjectName:    common.String(c.path),\n\t\tBucketName:    common.String(c.bucketName),\n\t\tIfMatch:       headResponse.ETag,\n\t\tRequestMetadata: common.RequestMetadata{\n\t\t\tRetryPolicy: getDefaultRetryPolicy(),\n\t\t},\n\t}\n\tif c.SSECustomerKey != \"\" && c.SSECustomerKeySHA256 != \"\" {\n\t\tgetRequest.OpcSseCustomerKey = common.String(c.SSECustomerKey)\n\t\tgetRequest.OpcSseCustomerKeySha256 = common.String(c.SSECustomerKeySHA256)\n\t\tgetRequest.OpcSseCustomerAlgorithm = common.String(c.SSECustomerAlgorithm)\n\t}\n\t// Get object from OCI\n\tgetResponse, err := c.objectStorageClient.GetObject(ctx, getRequest)\n\tif err != nil {\n\t\tvar ociErr common.ServiceError\n\t\tif errors.As(err, &ociErr) {\n\t\t\treturn nil, fmt.Errorf(\"failed to access object HttpStatusCode: %d\\nOpcRequestId: %s\\n message: %s\\n ErrorCode: %s\", ociErr.GetHTTPStatusCode(), ociErr.GetOpcRequestID(), ociErr.GetMessage(), ociErr.GetCode())\n\n\t\t}\n\t\treturn nil, fmt.Errorf(\"failed to access object '%s' in bucket '%s': %w\", c.path, c.bucketName, err)\n\t}\n\tdefer getResponse.Content.Close()\n\n\t// Read object content\n\tcontentArray, err := io.ReadAll(getResponse.Content)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to read 'content' from response: %w\", err)\n\t}\n\n\t// Compute MD5 hash\n\tmd5Hash := getResponse.ContentMd5\n\tif md5Hash == nil || len(*md5Hash) == 0 {\n\t\tmd5Hash = getResponse.OpcMultipartMd5\n\t}\n\t// Construct payload","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oci/client.go#L79-L115","documentation":"Raised in getObject after HeadObject succeeded but the follow-up GetObject call failed with an error that the OCI SDK recognizes as a common.ServiceError. Unlike the generic wrap, this path unpacks the structured service error and prints the HTTP status code, the OpcRequestId (for Oracle support), the human-readable message, and the OCI ErrorCode, so the failure can be correlated server-side.","triggerScenarios":"GetObject (client.go:93) returns an error for which errors.As(err, &ociErr) succeeds. Typical codes: 412 PreconditionFailed when IfMatch (headResponse.ETag at client.go:82) no longer matches (the object changed between head and get), 403, 401, 429, or a 5xx from the object storage service.","commonSituations":"Two processes writing the same state concurrently so the ETag changes between Head and Get; SSE-Customer-Key mismatch (wrong key/algo) causing the GET to fail decryption; throttling on a busy bucket; an object that was deleted or overwritten in the ~milliseconds between Head and Get; transient service degradation.","solutions":["Read the printed OpcRequestId and ErrorCode: give the exact code+requestId to OCI support or grep the OCI console audit log to locate the server-side failure.","For ErrorCode 412/PreconditionFailed or 'NotModified'/'Mismatch': re-run the operation; another process is mutating the state and the ETag-based IfMatch guard rejected the stale read.","For SSE-C errors confirm the opc-sse-customer-key / -sha256 / -algorithm backend attributes match the key that encrypted the object; a wrong key yields a decryption ServiceError.","For 429/5xx codes the retry policy already retries idempotent GETs; if it still bubbles up, throttle parallel Terraform runs and retry after a short backoff.","For 401/403 verify the IAM policy grants OBJECT_READ on the bucket for the running principal."],"exampleFix":"// before: stale ETag from a long gap between head and get\ngetResponse, err := c.objectStorageClient.GetObject(ctx, getRequest)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to access object HttpStatusCode: %d\\n...\", ociErr.GetHTTPStatusCode(), ...)\n}\n// after: drop IfMatch for a best-effort read (accepts whatever is current)\ngetRequest := objectstorage.GetObjectRequest{\n    NamespaceName: common.String(c.namespace),\n    ObjectName:    common.String(c.path),\n    BucketName:    common.String(c.bucketName),\n    RequestMetadata: common.RequestMetadata{RetryPolicy: getDefaultRetryPolicy()},\n}","handlingStrategy":"type-guard","validationCode":"// Validate the ETag you intend to pass as IfMatch is fresh (within the same op):\nheadResp, _ := c.objectStorageClient.HeadObject(ctx, headRequest)\nif headResp.ETag == nil { return fmt.Errorf(\"no ETag from head; cannot safely IfMatch GET\") }","typeGuard":"var se common.ServiceError\nif errors.As(err, &se) {\n    // se.GetHTTPStatusCode(), se.GetOpcRequestID(), se.GetMessage(), se.GetCode()\n    switch se.GetHTTPStatusCode() {\n    case 412: // precondition failed (etag mismatch)\n    case 429: // throttled\n    case 401, 403: // auth/authorization\n    }\n}","tryCatchPattern":"getResponse, err := c.objectStorageClient.GetObject(ctx, getRequest)\nif err != nil {\n    var se common.ServiceError\n    if errors.As(err, &se) {\n        return nil, fmt.Errorf(\"failed to access object HttpStatusCode: %d\\nOpcRequestId: %s\\n message: %s\\n ErrorCode: %s\",\n            se.GetHTTPStatusCode(), se.GetOpcRequestID(), se.GetMessage(), se.GetCode())\n    }\n    return nil, fmt.Errorf(\"failed to access object '%s' in bucket '%s': %w\", c.path, c.bucketName, err)\n}","preventionTips":["Minimize the gap between Head and Get to reduce ETag/precondition races.","Keep SSE-Customer key fields consistent across head and get.","Log the OpcRequestId from the error so support can trace the call.","Avoid concurrent writers mutating the same state object."],"tags":["oci","object-storage","get-object","service-error","etag","precondition","throttling","terraform-state"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}