{"record":{"id":"db51f8c5be8b81f1","repo":"hashicorp/terraform","slug":"there-is-no-any-available-accesskey-secret-and-se","errorCode":null,"errorMessage":"there is no any available accesskey, secret and security token for Ecs role %s","messagePattern":"there is no any available accesskey, secret and security token for Ecs role (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":705,"sourceCode":"\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeyId: %s\", err.Error())\n\t\treturn\n\t}\n\taccessKeySecret, err := jmespath.Search(\"AccessKeySecret\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeySecret: %s\", err.Error())\n\t\treturn\n\t}\n\tsecurityToken, err := jmespath.Search(\"SecurityToken\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get SecurityToken: %s\", err.Error())\n\t\treturn\n\t}\n\n\tif accessKeyId == nil || accessKeySecret == nil || securityToken == nil {\n\t\terr = fmt.Errorf(\"there is no any available accesskey, secret and security token for Ecs role %s\", ecsRoleName)\n\t\treturn\n\t}\n\n\treturn accessKeyId.(string), accessKeySecret.(string), securityToken.(string), nil\n}\n\nfunc getHttpProxyUrl(rawUrl string) (*url.URL, error) {\n\tpc := httpproxy.FromEnvironment()\n\tu, err := url.Parse(rawUrl)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn pc.ProxyFunc()(u)\n}\n","sourceCodeStart":687,"sourceCodeEnd":720,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L687-L720","documentation":"Final guard in getAuthCredentialByEcsRoleName (backend.go:704): all three JMESPath lookups returned nil error, but at least one of accessKeyId/accessKeySecret/securityToken is nil. I.e. the metadata service returned Code==\"Success\" with no actual credential values. This is a role-authorization failure rather than a parsing failure.","triggerScenarios":"JMESPath searches all succeed (nil error) but yield nil values, so the conditional at line 704 trips. Happens when the RAM role attached to the instance is not the one expected, or the role has no permission to mint credentials for this principal, yet the metadata endpoint still answers Success.","commonSituations":"Wrong ecs_role_name configured (typo or pointing at another account's role); role trust policy does not include the ECS service principal; role was deleted/renamed after attach; cross-account role assumption without the trust relationship.","solutions":["Confirm ecs_role_name in the backend block exactly matches the RAM role currently attached to the ECS instance.","In the RAM console, verify the role's trust policy trusts the ECS service principal (\"acs:ecs:*\").","Attach a system or custom policy to the role granting the needed OSS/TableStore permissions so credentials are actually issued.","Run terraform from a host with explicit AK/SK credentials if the role-attached metadata path cannot be fixed."],"exampleFix":"// before\nbackend \"oss\" {\n  bucket = \"tf-state\"\n  ecs_role_name = \"TfRole\"   // typo / case mismatch\n}\n\n// after\nbackend \"oss\" {\n  bucket = \"tf-state\"\n  ecs_role_name = \"tf-role\"  // exact RAM role name\n}","handlingStrategy":"validation","validationCode":"// Verify the role name resolves and yields a full credential triple before terraform runs.\nfunc validateEcsRole(role string) error {\n    ak, sk, tok, err := getAuthCredentialByEcsRoleName(role)\n    if err != nil {\n        return err\n    }\n    if ak == \"\" || sk == \"\" || tok == \"\" {\n        return fmt.Errorf(\"role %s issued incomplete credentials\", role)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Not retryable; it's an authorization outcome. Surface to the user and stop.\nif err != nil && strings.Contains(err.Error(), \"no any available accesskey\") {\n    return fmt.Errorf(\"RAM role %q not authorized for STS; check trust + permission policies\", role)\n}","preventionTips":["Cross-check ecs_role_name spelling against the RAM console exactly (case-sensitive).","Attach an Aliyun-managed policy (e.g. AliyunOSSFullAccess) to the role so credentials are actually granted.","In the role trust policy, trust the ECS service principal, not a generic RAM principal."],"tags":["alibaba-cloud","oss","ecs-sts","authentication","ram-role","authorization","go"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}