{"record":{"id":"8f1d20d0d987910d","repo":"hashicorp/terraform","slug":"get-ecs-sts-token-err-httpstatus-d-message","errorCode":null,"errorMessage":"get Ecs sts token err, httpStatus: %d, message = %s","messagePattern":"get Ecs sts token err, httpStatus: (.+?), message = (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":670,"sourceCode":"\t\terr = fmt.Errorf(\"build sts requests err: %s\", err.Error())\n\t\treturn\n\t}\n\thttpClient := &http.Client{}\n\thttpResponse, err := httpClient.Do(httpRequest)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"get Ecs sts token err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tresponse := responses.NewCommonResponse()\n\terr = responses.Unmarshal(response, httpResponse, \"\")\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unmarshal Ecs sts token response err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())\n\t\treturn\n\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())\n\t\treturn\n\t}\n\tcode, err := jmespath.Search(\"Code\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get Code: %s\", err.Error())\n\t\treturn\n\t}\n\tif code.(string) != \"Success\" {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, Code is not Success\")\n\t\treturn\n\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)","sourceCodeStart":652,"sourceCodeEnd":688,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L652-L688","documentation":"Returned by getAuthCredentialByEcsRoleName when the metadata service responds with a non-200 HTTP status. The message includes the status code and the body content. The metadata service should return 200 for a valid attached RAM role; anything else indicates the role is missing, the instance is unauthorized, or the service is erroring.","triggerScenarios":"ecs_role_name names a RAM role that is not attached to the instance (404), the instance has no RAM role at all, the role name is misspelled, or the metadata service returns 5xx during a transient fault.","commonSituations":"Attaching ecs_role_name in config before actually attaching the RAM role to the ECS instance in the console; role name typo; role attached in a different region/account; metadata service briefly 500s.","solutions":["In the Alibaba Cloud console, confirm the named RAM role is attached to THIS ECS instance.","Verify the role name spelling matches exactly (case-sensitive).","Ensure the RAM role's trust policy allows the ECS service to assume it.","curl http://100.100.100.200/latest/meta-data/ram/security-credentials/<role> to see the exact status/body.","Retry once for transient 5xx; if persistent, fall back to static/STS credentials."],"exampleFix":"# before: role 'app-role' not attached to instance\necs_role_name = \"app-role\"\n\n# after: attach 'app-role' to the ECS instance in RAM, then keep:\necs_role_name = \"app-role\"\n# or, until attached, use static creds:\naccess_key = \"LTAI...\"\nsecret_key = \"abc...\"","handlingStrategy":"validation","validationCode":"func roleAttached(role string) error {\n    u := \"http://100.100.100.200/latest/meta-data/ram/security-credentials/\" + role\n    resp, err := http.Get(u)\n    if err != nil { return err }\n    defer resp.Body.Close()\n    if resp.StatusCode != 200 {\n        return fmt.Errorf(\"metadata returned %d for role %q; is it attached?\", resp.StatusCode, role)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := getAuthCredentialByEcsRoleName(role); err != nil {\n    if strings.Contains(err.Error(), \"httpStatus\") {\n        return fmt.Errorf(\"RAM role %q not attached or unauthorized: %w\", role, err)\n    }\n    return err\n}","preventionTips":["Attach the RAM role to the instance before referencing it.","Match the role name exactly (case-sensitive).","Verify the role's trust policy includes ECS."],"tags":["oss","ecs","metadata","auth","http-status","ram-role","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}