{"record":{"id":"dd5a5aa88c78ff3e","repo":"hashicorp/terraform","slug":"refresh-ecs-sts-token-err-fail-to-get-accesskeyid","errorCode":null,"errorMessage":"refresh Ecs sts token err, fail to get AccessKeyId: %s","messagePattern":"refresh Ecs sts token err, fail to get AccessKeyId: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":690,"sourceCode":"\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())\n\t\treturn\n\t}\n\tcode, err := jmespath.Search(\"Code\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get Code: %s\", err.Error())\n\t\treturn\n\t}\n\tif code.(string) != \"Success\" {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, Code is not Success\")\n\t\treturn\n\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeyId: %s\", err.Error())\n\t\treturn\n\t}\n\taccessKeySecret, err := jmespath.Search(\"AccessKeySecret\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeySecret: %s\", err.Error())\n\t\treturn\n\t}\n\tsecurityToken, err := jmespath.Search(\"SecurityToken\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get SecurityToken: %s\", err.Error())\n\t\treturn\n\t}\n\n\tif accessKeyId == nil || accessKeySecret == nil || securityToken == nil {\n\t\terr = fmt.Errorf(\"there is no any available accesskey, secret and security token for Ecs role %s\", ecsRoleName)\n\t\treturn\n\t}\n","sourceCodeStart":672,"sourceCodeEnd":708,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L672-L708","documentation":"Returned by getAuthCredentialByEcsRoleName when jmespath.Search(\"AccessKeyId\", data) fails after Code == \"Success\". The credential payload is present but the AccessKeyId field could not be evaluated — JMESPath error, not merely a missing key (a missing key would return nil and be caught by the later nil check at line 704).","triggerScenarios":"The metadata JSON declares Code = Success but the AccessKeyId field has an unexpected type or the document structure breaks JMESPath traversal (e.g. AccessKeyId is a nested object or array rather than a string). Rare; usually a malformed/partial metadata response.","commonSituations":"Transient metadata service returning a partial/oddly-shaped success envelope; very rare schema drift; intermediary mutating the JSON.","solutions":["curl the metadata URL and confirm \"AccessKeyId\" is a top-level string.","Retry — this is almost always transient.","Re-attach the RAM role or recreate it to force a clean metadata envelope.","Fall back to static/STS credentials if it persists."],"exampleFix":"# before: metadata returns Success but no/partial AccessKeyId\necs_role_name = \"partial-role\"\n\n# after: re-attach a healthy RAM role whose metadata returns\n# {\"Code\":\"Success\",\"AccessKeyId\":\"STS...\",...}\necs_role_name = \"healthy-role\"","handlingStrategy":"validation","validationCode":"func metadataHasAccessKeyId(role string) error {\n    u := \"http://100.100.100.200/latest/meta-data/ram/security-credentials/\" + role\n    resp, err := http.Get(u)\n    if err != nil { return err }\n    defer resp.Body.Close()\n    var m map[string]interface{}\n    json.NewDecoder(resp.Body).Decode(&m)\n    if _, ok := m[\"AccessKeyId\"].(string); !ok {\n        return fmt.Errorf(\"metadata missing string AccessKeyId: %#v\", m)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := getAuthCredentialByEcsRoleName(role); err != nil {\n    if strings.Contains(err.Error(), \"fail to get AccessKeyId\") {\n        time.Sleep(2 * time.Second)\n        return getAuthCredentialByEcsRoleName(role) // bounded retry for partial envelope\n    }\n    return err\n}","preventionTips":["Confirm the metadata envelope returns AccessKeyId as a string.","Re-attach the RAM role to regenerate a clean envelope.","Fall back to static/STS creds if the envelope stays malformed."],"tags":["oss","ecs","metadata","auth","jmespath","credentials","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}