{"record":{"id":"81443eb705c794b3","repo":"hashicorp/terraform","slug":"failed-to-upload-state-s-v","errorCode":null,"errorMessage":"failed to upload state %s: %#v","messagePattern":"failed to upload state (.+?): %#v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/client.go","lineNumber":121,"sourceCode":"\tif err != nil {\n\t\treturn diags.Append(fmt.Errorf(\"error getting bucket: %#v\", err))\n\t}\n\n\tbody := bytes.NewReader(data)\n\n\tvar options []oss.Option\n\tif c.acl != \"\" {\n\t\toptions = append(options, oss.ACL(oss.ACLType(c.acl)))\n\t}\n\toptions = append(options, oss.ContentType(\"application/json\"))\n\tif c.serverSideEncryption {\n\t\toptions = append(options, oss.ServerSideEncryption(\"AES256\"))\n\t}\n\toptions = append(options, oss.ContentLength(int64(len(data))))\n\n\tif body != nil {\n\t\tif err := bucket.PutObject(c.stateFile, body, options...); err != nil {\n\t\t\treturn diags.Append(fmt.Errorf(\"failed to upload state %s: %#v\", c.stateFile, err))\n\t\t}\n\t}\n\n\tsum := md5.Sum(data)\n\tif err := c.putMD5(sum[:]); err != nil {\n\t\t// if this errors out, we unfortunately have to error out altogether,\n\t\t// since the next Get will inevitably fail.\n\t\treturn diags.Append(fmt.Errorf(\"failed to store state MD5: %s\", err))\n\t}\n\treturn diags\n}\n\nfunc (c *RemoteClient) Delete() tfdiags.Diagnostics {\n\tvar diags tfdiags.Diagnostics\n\tbucket, err := c.ossClient.Bucket(c.bucketName)\n\tif err != nil {\n\t\treturn diags.Append(fmt.Errorf(\"error getting bucket %s: %#v\", c.bucketName, err))\n\t}","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/client.go#L103-L139","documentation":"In RemoteClient.Put() (client.go:120-121), bucket.PutObject(stateFile, body, options...) failed uploading the state JSON to OSS. %#v surfaces the full OSS SDK error (code + request-id). This is the actual network/permissions write failure as opposed to the local Bucket() validation.","triggerScenarios":"PutObject returns an error: NoSuchBucket, AccessDenied, RequestTimeout, SignatureDoesNotMatch, slow read/write timeout, or a transient 5xx from OSS. ACL, SSE, Content-Length options are attached so misconfig of acl/server_side_encryption can also trigger it.","commonSituations":"Bucket deleted after init; credentials rotated/expired; acl value not a valid OSS canned ACL; server_side_encryption=true against a bucket with conflicting KMS config; large state hitting body/timeout limits; network/proxy egress blocked to oss-*.aliyuncs.com.","solutions":["Read the %#v detail: NoSuchBucket -> recreate/fix bucket; AccessDenied -> grant oss:PutObject and check RAM role.","Validate acl is one of private/public-read/public-read-write/default (oss.ACLType cast expects a canned value).","If using a proxy, ensure HTTPS egress to the OSS endpoint is allowed.","Re-run terraform apply; PutObject is safe to retry as it overwrites the key atomically."],"exampleFix":"// before\nbackend \"oss\" {\n  bucket = \"tf-state\"\n  acl = \"public\"   // invalid canned ACL\n}\n\n// after\nbackend \"oss\" {\n  bucket = \"tf-state\"\n  acl = \"private\"\n}","handlingStrategy":"retry","validationCode":"// Validate acl/server_side_encryption values and credential scope before apply.\nfunc validACL(a string) bool {\n    switch a {\n    case \"\", \"private\", \"public-read\", \"public-read-write\", \"default\":\n        return true\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"// Inspect the OSS error code in %#v; retry on transient 5xx/timeout,\n// fail fast on AccessDenied/SignatureDoesNotMatch.\nif oe, ok := err.(oss.ServiceError); ok {\n    switch oe.StatusCode {\n    case 500, 502, 503, 408:\n        return retry() // PutObject is idempotent overwrite\n    default:\n        return fail(oe)\n    }\n}","preventionTips":["Use only valid OSS canned ACLs in the acl attribute.","Ensure oss:PutObject is granted on the state prefix.","Keep state files reasonably sized; very large states amplify timeout risk."],"tags":["alibaba-cloud","oss","remote-state","object-upload","permissions","go"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}