{"record":{"id":"88e6c3c9c8a4c47e","repo":"hashicorp/terraform","slug":"get-ecs-sts-token-err-s","errorCode":null,"errorMessage":"get Ecs sts token err : %s","messagePattern":"get Ecs sts token err : (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":658,"sourceCode":"// Actually, the job should be done by sdk, but currently not all resources and products support alibaba-cloud-sdk-go,\n// and their go sdk does support ecs role name.\n// This method is a temporary solution and it should be removed after all go sdk support ecs role name\n// The related PR: https://github.com/terraform-providers/terraform-provider-alicloud/pull/731\nfunc getAuthCredentialByEcsRoleName(ecsRoleName string) (accessKey, secretKey, token string, err error) {\n\n\tif ecsRoleName == \"\" {\n\t\treturn\n\t}\n\trequestUrl := securityCredURL + ecsRoleName\n\thttpRequest, err := http.NewRequest(requests.GET, requestUrl, strings.NewReader(\"\"))\n\tif err != nil {\n\t\terr = fmt.Errorf(\"build sts requests err: %s\", err.Error())\n\t\treturn\n\t}\n\thttpClient := &http.Client{}\n\thttpResponse, err := httpClient.Do(httpRequest)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"get Ecs sts token err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tresponse := responses.NewCommonResponse()\n\terr = responses.Unmarshal(response, httpResponse, \"\")\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unmarshal Ecs sts token response err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())\n\t\treturn\n\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())","sourceCodeStart":640,"sourceCodeEnd":676,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L640-L676","documentation":"Returned by getAuthCredentialByEcsRoleName when httpClient.Do fails for the GET to the ECS metadata service at 100.100.100.200. This is the network-level failure: the instance cannot reach its own metadata service.","triggerScenarios":"The code is NOT actually running on an Alibaba Cloud ECS instance (so 100.100.100.200 is unreachable); the metadata service is blocked by a custom network namespace/iptables; ECS instance is in a broken/stopped state; tight firewall rules dropping link-local traffic.","commonSituations":"Setting ecs_role_name on a local dev machine or non-Alibaba VM; running in a container with host network disabled; misconfigured VPC/security group blocking metadata; instance hibernation.","solutions":["Only set ecs_role_name when running on an Alibaba Cloud ECS instance with the RAM role attached.","If running elsewhere, remove ecs_role_name and provide access_key/secret_key (or security_token) instead.","On the instance, verify reachability: curl http://100.100.100.200/latest/meta-data/ from a shell.","Ensure no local firewall/iptables blocks the 169.254/100.100 link-local range."],"exampleFix":"# before: ecs_role_name set on a non-ECS host\necs_role_name = \"my-ram-role\"\n\n# after: use static creds off-ECS\naccess_key = \"LTAI...\"\nsecret_key = \"abc...\"\n# (remove ecs_role_name)","handlingStrategy":"validation","validationCode":"func isOnECS() bool {\n    resp, err := http.Get(\"http://100.100.100.200/latest/meta-data/\")\n    return err == nil && resp.StatusCode == 200\n}","typeGuard":null,"tryCatchPattern":"if _, err := getAuthCredentialByEcsRoleName(role); err != nil {\n    if strings.Contains(err.Error(), \"get Ecs sts token err\") {\n        // not on ECS, or metadata blocked -> use static creds\n        return staticCreds()\n    }\n    return err\n}","preventionTips":["Only configure ecs_role_name on real Alibaba ECS.","curl the metadata URL to verify reachability.","Keep a static-credential fallback ready."],"tags":["oss","ecs","metadata","auth","network","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}