{"record":{"id":"70daa666867a5b53","repo":"hashicorp/terraform","slug":"failed-to-create-tag-s-s-s","errorCode":null,"errorMessage":"failed to create tag: %s -> %s: %s","messagePattern":"failed to create tag: (.+?) -> (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/cos/client.go","lineNumber":431,"sourceCode":"\n\ttagKey := response.Response.Tags[0].TagKey\n\ttagValue := response.Response.Tags[0].TagValue\n\n\texists = key == *tagKey && value == *tagValue\n\n\treturn\n}\n\n// CreateTag create tag by key and value\nfunc (c *remoteClient) CreateTag(key, value string) error {\n\trequest := tag.NewCreateTagRequest()\n\trequest.TagKey = &key\n\trequest.TagValue = &value\n\n\t_, err := c.tagClient.CreateTag(request)\n\tlog.Printf(\"[DEBUG] create tag %s:%s: error: %v\", key, value, err)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create tag: %s -> %s: %s\", key, value, err)\n\t}\n\n\treturn nil\n}\n\n// DeleteTag create tag by key and value\nfunc (c *remoteClient) DeleteTag(key, value string) error {\n\trequest := tag.NewDeleteTagRequest()\n\trequest.TagKey = &key\n\trequest.TagValue = &value\n\n\t_, err := c.tagClient.DeleteTag(request)\n\tlog.Printf(\"[DEBUG] delete tag %s:%s: error: %v\", key, value, err)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to delete tag: %s -> %s: %s\", key, value, err)\n\t}\n\n\treturn nil","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/cos/client.go#L413-L449","documentation":"Raised by CreateTag() when the Tencent Cloud Tag service's CreateTag API returns an error. Tags are used by the COS backend as a distributed lock (lockTagKey='tencentcloud-terraform-lock') keyed by an md5 of bucket:lockfile, so a failure to create the lock tag means the state lock could not be acquired.","triggerScenarios":"At client.go:428-431: c.tagClient.CreateTag(request) returns err. Triggered during Lock() (via cosLock -> CreateTag). Occurs when the tag principal lacks QcloudTAGFullAccess/tag:CreateTag, the tag key/value already exists, STS token expired, or the Tag API region/service is unavailable.","commonSituations":"Backend credentials have COS rights but not Tag service rights; secret key is for a sub-account without tag permissions; STS temporary credentials expired mid-run; tag quota exceeded; Tag API rate-limited.","solutions":["Grant the credentials QcloudTAGFullAccess (or scoped tag:CreateTag/tag:DeleteTag/tag:DescribeTags) on the Tag service.","Retry the apply — transient STS/rate-limit failures often clear.","Confirm the tag region matches the Tag service region the SDK is using.","If a stale lock tag from a crashed run is the cause, locate and remove it via the Tag console, then re-run."],"exampleFix":"# attach Tag policy to the IAM principal used by the backend\n# policy: QcloudTAGFullAccess  (or scoped QcloudTAGDataFullAccess is insufficient for Create/Delete)\n# then retry\nterraform apply","handlingStrategy":"retry","validationCode":"// Verify the principal has Tag service rights before locking.\nfunc canUseTagService(ctx context.Context, t *tag.Client, key string) error {\n    req := tag.NewDescribeTagsRequest()\n    req.TagKey = &key\n    _, err := t.DescribeTags(req)\n    return err\n}","typeGuard":null,"tryCatchPattern":"if err := c.Lock(info); err != nil {\n    // tag create failed: grant QcloudTAGFullAccess / tag:CreateTag, refresh STS, retry\n}","preventionTips":["Grant QcloudTAGFullAccess (Create/Describe/Delete) to the backend principal.","Refresh STS tokens before they expire during long applies.","Keep tag count under the Tencent quota."],"tags":["cos","tencent-cloud","tag","lock","iam","sts","permissions"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}