{"record":{"id":"a9314101b1269f39","repo":"hashicorp/terraform","slug":"unmarshal-ecs-sts-token-response-err-s","errorCode":null,"errorMessage":"unmarshal Ecs sts token response err : %s","messagePattern":"unmarshal Ecs sts token response err : (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":665,"sourceCode":"\t\treturn\n\t}\n\trequestUrl := securityCredURL + ecsRoleName\n\thttpRequest, err := http.NewRequest(requests.GET, requestUrl, strings.NewReader(\"\"))\n\tif err != nil {\n\t\terr = fmt.Errorf(\"build sts requests err: %s\", err.Error())\n\t\treturn\n\t}\n\thttpClient := &http.Client{}\n\thttpResponse, err := httpClient.Do(httpRequest)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"get Ecs sts token err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tresponse := responses.NewCommonResponse()\n\terr = responses.Unmarshal(response, httpResponse, \"\")\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unmarshal Ecs sts token response err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())\n\t\treturn\n\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())\n\t\treturn\n\t}\n\tcode, err := jmespath.Search(\"Code\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get Code: %s\", err.Error())\n\t\treturn\n\t}","sourceCodeStart":647,"sourceCodeEnd":683,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L647-L683","documentation":"Returned by getAuthCredentialByEcsRoleName when responses.Unmarshal fails to parse the HTTP response from the ECS metadata service into a CommonResponse. This is a low-level unmarshal failure, typically an encoding/content-type problem rather than a logical one.","triggerScenarios":"The metadata service returns a body that the alibaba-cloud-sdk-go responses.Unmarshal cannot decode (unexpected Content-Encoding, truncated chunked response, gzip when none expected). Distinct from a non-200 status (error 335) or JSON parse failure (error 336).","commonSituations":"A transparent proxy mangling/compressing metadata responses; SDK version skew where the transport encoding changed; rare metadata service hiccup returning a malformed frame.","solutions":["Retry the operation — transient transport corruption is the most common cause.","Check for any HTTP proxy intercepting 100.100.100.200 traffic and disable it for link-local.","Verify the alibaba-cloud-sdk-go dependency version is current; older versions had unmarshal edge cases.","curl the metadata URL directly to inspect the raw response framing."],"exampleFix":"# before: egress proxy rewriting metadata responses\nHTTP_PROXY=http://corp-proxy:8080\n\n# after: exclude the metadata host\nNO_PROXY=100.100.100.200,169.254.169.254\nHTTP_PROXY=http://corp-proxy:8080","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := getAuthCredentialByEcsRoleName(role); err != nil {\n    if strings.Contains(err.Error(), \"unmarshal Ecs sts token response\") {\n        time.Sleep(2 * time.Second)\n        return getAuthCredentialByEcsRoleName(role) // one bounded retry\n    }\n    return err\n}","preventionTips":["Bypass proxies for 100.100.100.200 (NO_PROXY).","Keep alibaba-cloud-sdk-go updated.","curl the metadata URL to inspect raw framing."],"tags":["oss","ecs","metadata","auth","unmarshal","network","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}