{"record":{"id":"5ada72864d11c620","repo":"hashicorp/terraform","slug":"describe-oss-endpoint-using-region-v-got-an-err","errorCode":null,"errorMessage":"describe oss endpoint using region: %#v got an error: %#v","messagePattern":"describe oss endpoint using region: %#v got an error: %#v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":458,"sourceCode":"\n\treturn err\n}\n\nfunc (b *Backend) getOSSEndpointByRegion(access_key, secret_key, security_token, region string) (*location.DescribeEndpointsResponse, error) {\n\targs := location.CreateDescribeEndpointsRequest()\n\targs.ServiceCode = \"oss\"\n\targs.Id = region\n\targs.Domain = \"location-readonly.aliyuncs.com\"\n\n\tlocationClient, err := location.NewClientWithOptions(region, getSdkConfig(), credentials.NewStsTokenCredential(access_key, secret_key, security_token))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to initialize the location client: %#v\", err)\n\n\t}\n\tlocationClient.AppendUserAgent(TerraformUA, TerraformVersion)\n\tendpointsResponse, err := locationClient.DescribeEndpoints(args)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"describe oss endpoint using region: %#v got an error: %#v\", region, err)\n\t}\n\treturn endpointsResponse, nil\n}\n\nfunc getAssumeRoleAK(accessKey, secretKey, stsToken, region, roleArn, sessionName, policy, stsEndpoint string, sessionExpiration int) (string, string, string, error) {\n\trequest := sts.CreateAssumeRoleRequest()\n\trequest.RoleArn = roleArn\n\trequest.RoleSessionName = sessionName\n\trequest.DurationSeconds = requests.NewInteger(sessionExpiration)\n\trequest.Policy = policy\n\trequest.Scheme = \"https\"\n\n\tvar client *sts.Client\n\tvar err error\n\tif stsToken == \"\" {\n\t\tclient, err = sts.NewClientWithAccessKey(region, accessKey, secretKey)\n\t} else {\n\t\tclient, err = sts.NewClientWithStsToken(region, accessKey, secretKey, stsToken)","sourceCodeStart":440,"sourceCodeEnd":476,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L440-L476","documentation":"Returned by getOSSEndpointByRegion when locationClient.DescribeEndpoints returns an error while querying the Alibaba Cloud Location service (location-readonly.aliyuncs.com) for the OSS endpoint of the given region. The %#v shows both the region and the SDK error.","triggerScenarios":"DescribeEndpoints API call fails: invalid/expired credentials, region unknown to the Location service, network/proxy blocking location-readonly.aliyuncs.com, or the Location service itself returning an error. Note configure() catches this as a WARN and falls back to oss-<region>.aliyuncs.com, so it is usually non-fatal.","commonSituations":"Corporate egress proxy blocking the Location domain; transient Location service outage; using a new/isolated region not yet in the Location catalog; stale STS token.","solutions":["Set an explicit endpoint in the backend block (endpoint = \"oss-cn-hangzhou.aliyuncs.com\") to bypass Location discovery entirely.","Verify network egress to location-readonly.aliyuncs.com (and the OSS domain) is allowed by proxies/firewalls.","Refresh credentials if the wrapped error indicates auth failure (InvalidAccessKeyId / SecurityTokenExpired).","Accept the fallback: configure() logs a WARN and uses oss-<region>.aliyuncs.com, which is usually correct."],"exampleFix":"# before: relies on Location discovery that is blocked by proxy\nregion = \"cn-hangzhou\"\n\n# after: pin the endpoint\nregion   = \"cn-hangzhou\"\nendpoint = \"oss-cn-hangzhou.aliyuncs.com\"","handlingStrategy":"fallback","validationCode":"// Pre-resolve the endpoint to skip Location discovery entirely.\nfunc resolveEndpoint(region, explicit string) string {\n    if explicit != \"\" { return explicit }\n    if region == \"\" { return \"\" }\n    return fmt.Sprintf(\"oss-%s.aliyuncs.com\", region)\n}","typeGuard":null,"tryCatchPattern":"// configure() already treats this as a WARN and falls back.\nif _, err := b.getOSSEndpointByRegion(ak, sk, tok, region); err != nil {\n    endpoint = fmt.Sprintf(\"oss-%s.aliyuncs.com\", region)\n}","preventionTips":["Pin endpoint explicitly to avoid Location dependency.","Allow egress to location-readonly.aliyuncs.com.","Keep credentials fresh."],"tags":["oss","location","network","endpoint","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}