{"record":{"id":"5b01dcff16081db2","repo":"hashicorp/terraform","slug":"failed-to-upload-object-w","errorCode":null,"errorMessage":"failed to upload object: %w","messagePattern":"failed to upload object: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/client.go","lineNumber":195,"sourceCode":"\t\tRequestMetadata: common.RequestMetadata{\n\t\t\tRetryPolicy: getDefaultRetryPolicy(),\n\t\t},\n\t}\n\n\t// Handle encryption settings\n\tif c.kmsKeyID != \"\" {\n\t\tputRequest.OpcSseKmsKeyId = common.String(c.kmsKeyID)\n\t} else if c.SSECustomerKey != \"\" && c.SSECustomerKeySHA256 != \"\" {\n\t\tputRequest.OpcSseCustomerKey = common.String(c.SSECustomerKey)\n\t\tputRequest.OpcSseCustomerKeySha256 = common.String(c.SSECustomerKeySHA256)\n\t\tputRequest.OpcSseCustomerAlgorithm = common.String(c.SSECustomerAlgorithm)\n\t}\n\n\tlogger.Info(fmt.Sprintf(\"Uploading remote state: %s\", c.path))\n\n\tputResponse, err := c.objectStorageClient.PutObject(ctx, putRequest)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to upload object: %w\", err)\n\t}\n\n\tlogger.Info(\"Uploaded state file response: %+v\\n\", putResponse)\n\treturn nil\n}\n\nfunc (c *RemoteClient) Delete() tfdiags.Diagnostics {\n\tvar diags tfdiags.Diagnostics\n\n\treturn diags.Append(c.DeleteAllObjectVersions())\n}\nfunc (c *RemoteClient) DeleteAllObjectVersions() error {\n\trequest := objectstorage.ListObjectVersionsRequest{\n\t\tBucketName:    common.String(c.bucketName),\n\t\tNamespaceName: common.String(c.namespace),\n\t\tPrefix:        common.String(c.path),\n\t\tRequestMetadata: common.RequestMetadata{\n\t\t\tRetryPolicy: getDefaultRetryPolicy(),","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oci/client.go#L177-L213","documentation":"Raised in uploadSinglePartObject when the OCI PutObject call fails. It wraps the raw SDK error returned by objectstorage.ObjectStorageClient.PutObject (client.go:193), so the underlying cause (auth, authorization, bucket-not-found, KMS key invalid, SSE-C mismatch, quota, throttling, network) is in the wrapped %w chain. This is the primary single-part state-write failure path.","triggerScenarios":"PutObject returns a non-nil error: 401/403 lacking OBJECT_CREATE/OBJECT_OVERWRITE, 400 when ContentMD5 (client.go:176) does not match the body (corruption in transit), 400 InvalidParameter for a bad KMS key id (OpcSseKmsKeyId), 412 If-Match conflicts, 429, or a 5xx/network error.","commonSituations":"KMS key id misconfigured or in a different region/tenancy; SSE-Customer key fields inconsistent; the bucket has immutability/worm retention blocking overwrite; insufficient IAM OBJECT_OVERWRITE permission; running out of storage quota; network reset during upload of a large single part.","solutions":["Unwrap the error and read the OCI ErrorCode: 403 -> add OBJECT_CREATE/OBJECT_OVERWRITE to the IAM policy; InvalidParameter -> fix the kms_key_id / SSE-C fields.","Verify the KMS key id in the backend config is a valid OCID in the same region and that the principal has KEY_INSPECT/KEY_USE on it.","If the bucket is immutable/retention-locked, confirm overwrite is allowed for the current clock and object age.","For ContentMD5 mismatch (body corruption) re-run; if recurring, check memory/disk corruption or a tampering proxy.","For throttling, reduce concurrent writers and rely on getDefaultRetryPolicy; sustained 429s need a limit increase."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight checks before PutObject:\nif c.kmsKeyID != \"\" && !strings.HasPrefix(c.kmsKeyID, \"ocid1.key.ocid\") {\n    return fmt.Errorf(\"invalid kms_key_id: %s\", c.kmsKeyID)\n}\nif len(data) == 0 { return fmt.Errorf(\"empty body\") }\nif ctx.Err() != nil { return ctx.Err() }","typeGuard":"var se common.ServiceError\nif errors.As(err, &se) {\n    switch se.GetHTTPStatusCode() {\n    case 403: // need OBJECT_CREATE/OBJECT_OVERWRITE\n    case 400: // InvalidParameter (bad KMS key / md5 mismatch)\n    case 429: // throttled\n    }\n}","tryCatchPattern":"putResponse, err := c.objectStorageClient.PutObject(ctx, putRequest)\nif err != nil {\n    return fmt.Errorf(\"failed to upload object: %w\", err)\n}","preventionTips":["Grant OBJECT_CREATE + OBJECT_OVERWRITE on the state bucket.","Use a valid in-region KMS key OCID for encryption.","Keep SSE-C key fields mutually consistent if used.","Avoid concurrent overwrites on an immutable/retention-locked bucket."],"tags":["oci","object-storage","put-object","auth","permissions","kms","encryption","throttling","terraform-state"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}