{"record":{"id":"bc9d1fd37f88b322","repo":"hashicorp/terraform","slug":"refresh-ecs-sts-token-err-fail-to-get-code-s","errorCode":null,"errorMessage":"refresh Ecs sts token err, fail to get Code: %s","messagePattern":"refresh Ecs sts token err, fail to get Code: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":681,"sourceCode":"\terr = responses.Unmarshal(response, httpResponse, \"\")\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unmarshal Ecs sts token response err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())\n\t\treturn\n\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())\n\t\treturn\n\t}\n\tcode, err := jmespath.Search(\"Code\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get Code: %s\", err.Error())\n\t\treturn\n\t}\n\tif code.(string) != \"Success\" {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, Code is not Success\")\n\t\treturn\n\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeyId: %s\", err.Error())\n\t\treturn\n\t}\n\taccessKeySecret, err := jmespath.Search(\"AccessKeySecret\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeySecret: %s\", err.Error())\n\t\treturn\n\t}\n\tsecurityToken, err := jmespath.Search(\"SecurityToken\", data)\n\tif err != nil {","sourceCodeStart":663,"sourceCodeEnd":699,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L663-L699","documentation":"Returned by getAuthCredentialByEcsRoleName when jmespath.Search(\"Code\", data) fails against the parsed metadata JSON. This indicates the JSON parsed (error 336 did not fire) but either lacks a 'Code' field or the JMESPath evaluation errored — typically the field is absent, meaning the response shape is unexpected.","triggerScenarios":"The metadata JSON lacks a top-level 'Code' key — e.g. it is a wrapped error object, an array, or an unexpected schema variant. jmespath.Search returns an error when evaluation fails (not merely when the key is missing, which returns nil).","commonSituations":"Metadata service returning a non-standard error envelope (still valid JSON) during a partial outage; SDK/schema drift in the metadata API; an intermediary returning a JSON error object instead of the credentials object.","solutions":["curl the metadata URL and inspect the JSON structure — confirm a top-level \"Code\" field exists.","Retry for transient metadata schema hiccups.","If the role is misconfigured, re-attach the RAM role to the instance and confirm it returns the standard envelope.","Fall back to static/STS credentials if the metadata shape stays non-standard."],"exampleFix":"# before: metadata returns {\"error\":\"role not found\"} (no Code field)\necs_role_name = \"missing-role\"\n\n# after: attach a valid role whose metadata returns\n# {\"Code\":\"Success\",\"AccessKeyId\":...,...}\necs_role_name = \"attached-role\"","handlingStrategy":"validation","validationCode":"func metadataHasCode(role string) error {\n    u := \"http://100.100.100.200/latest/meta-data/ram/security-credentials/\" + role\n    resp, err := http.Get(u)\n    if err != nil { return err }\n    defer resp.Body.Close()\n    var m map[string]interface{}\n    json.NewDecoder(resp.Body).Decode(&m)\n    if _, ok := m[\"Code\"]; !ok {\n        return fmt.Errorf(\"metadata response missing 'Code' field: %#v\", m)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := getAuthCredentialByEcsRoleName(role); err != nil {\n    if strings.Contains(err.Error(), \"fail to get Code\") {\n        time.Sleep(2 * time.Second)\n        return getAuthCredentialByEcsRoleName(role)\n    }\n    return err\n}","preventionTips":["Verify the metadata envelope has a top-level Code field.","Re-attach the RAM role to reset the envelope.","Retry transient schema drift."],"tags":["oss","ecs","metadata","auth","jmespath","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}