{"record":{"id":"8281b15772d42721","repo":"hashicorp/terraform","slug":"failed-to-delete-tag-s-s-s","errorCode":null,"errorMessage":"failed to delete tag: %s -> %s: %s","messagePattern":"failed to delete tag: (.+?) -> (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/cos/client.go","lineNumber":446,"sourceCode":"\t_, err := c.tagClient.CreateTag(request)\n\tlog.Printf(\"[DEBUG] create tag %s:%s: error: %v\", key, value, err)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create tag: %s -> %s: %s\", key, value, err)\n\t}\n\n\treturn nil\n}\n\n// DeleteTag create tag by key and value\nfunc (c *remoteClient) DeleteTag(key, value string) error {\n\trequest := tag.NewDeleteTagRequest()\n\trequest.TagKey = &key\n\trequest.TagValue = &value\n\n\t_, err := c.tagClient.DeleteTag(request)\n\tlog.Printf(\"[DEBUG] delete tag %s:%s: error: %v\", key, value, err)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to delete tag: %s -> %s: %s\", key, value, err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":428,"sourceCodeEnd":451,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/cos/client.go#L428-L451","documentation":"Raised by DeleteTag() when the Tencent Cloud Tag service's DeleteTag API returns an error. DeleteTag is called during Unlock() (via cosUnlock) to release the state lock; failure means the lock tag could not be removed, leaving the state potentially locked. cosUnlock retries up to 30 times with 1s sleeps before surfacing the error.","triggerScenarios":"At client.go:443-446: c.tagClient.DeleteTag(request) returns err after the 30-iteration retry loop in cosUnlock exhausts. Occurs when tag permissions are insufficient, the tag does not exist, STS expired, or the Tag API is unavailable over the whole retry window.","commonSituations":"Sub-account credentials with COS rights but not Tag:DeleteTag rights; STS token expired during a long apply; tag was already deleted by a concurrent unlock; Tag API regional outage lasting >30s.","solutions":["Grant the credentials tag:DeleteTag (or QcloudTAGFullAccess) and re-attempt the unlock.","If the unlock already partially succeeded, manually check the Tag console for the 'tencentcloud-terraform-lock' tag and remove it if stale.","Re-authenticate with fresh credentials/STS and retry 'terraform force-unlock <lock-id>'.","If 5xx, wait for Tag service recovery and retry."],"exampleFix":"# grant tag:DeleteTag, then force-unlock\nterraform force-unlock <lock-id>\n# or remove the stale tag value under key 'tencentcloud-terraform-lock' in the Tag console","handlingStrategy":"retry","validationCode":"// Verify tag:DeleteTag permission before relying on auto-unlock.\nfunc canDeleteTag(ctx context.Context, t *tag.Client) error {\n    // best-effort: DescribeTags works but Create/Delete need QcloudTAGFullAccess\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := c.Unlock(check); err != nil {\n    // tag delete failed after 30 retries: grant tag:DeleteTag, or 'terraform force-unlock' + manual tag removal\n}","preventionTips":["Grant tag:DeleteTag (or QcloudTAGFullAccess) to the principal.","Keep STS tokens valid for the whole apply window.","Know how to 'terraform force-unlock' and remove stale 'tencentcloud-terraform-lock' tags manually."],"tags":["cos","tencent-cloud","tag","unlock","lock","iam","sts","permissions"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}