{"record":{"id":"ee564105959d0577","repo":"hashicorp/terraform","slug":"refresh-ecs-sts-token-err-code-is-not-success","errorCode":null,"errorMessage":"refresh Ecs sts token err, Code is not Success","messagePattern":"refresh Ecs sts token err, Code is not Success","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":685,"sourceCode":"\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())\n\t\treturn\n\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())\n\t\treturn\n\t}\n\tcode, err := jmespath.Search(\"Code\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get Code: %s\", err.Error())\n\t\treturn\n\t}\n\tif code.(string) != \"Success\" {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, Code is not Success\")\n\t\treturn\n\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeyId: %s\", err.Error())\n\t\treturn\n\t}\n\taccessKeySecret, err := jmespath.Search(\"AccessKeySecret\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeySecret: %s\", err.Error())\n\t\treturn\n\t}\n\tsecurityToken, err := jmespath.Search(\"SecurityToken\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get SecurityToken: %s\", err.Error())\n\t\treturn\n\t}\n","sourceCodeStart":667,"sourceCodeEnd":703,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oss/backend.go#L667-L703","documentation":"Thrown when refreshing an ECS STS token: the metadata service returned HTTP 200 and parseable JSON, the 'Code' field was extracted, but its value was not the string \"Success\". The role-assumption call was rejected by the metadata service for a semantic reason (auth, throttling, role state) even though transport succeeded.","triggerScenarios":"The ECS RAM role metadata endpoint returns a body whose Code is e.g. \"InvalidRamRole\", \"NoPermission\", \"ServiceUnavailable\", or similar — any non-\"Success\" code. Common when the role is being deleted, the instance is detached from the role, or the metadata service is throttling.","commonSituations":"A RAM role was detached from the running ECS instance, or the role's trust policy no longer permits the ECS service to assume it. Also occurs during transient metadata-service issues or when the region's metadata endpoint is degraded.","solutions":["In the Alibaba Cloud console, verify the ECS instance still has the expected RAM role attached.","Check the RAM role's trust policy allows the ecs.aliyuncs.com service principal to assume it.","Curl the metadata endpoint from the host and read the full body — the non-Success Code and Message will state the cause.","Retry after a short wait; if Code indicates throttling (e.g. ServiceUnavailable), reduce concurrent credential-refreshing operations."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight: fetch metadata and assert Code == \"Success\" before relying on it.\nresp, err := metaClient.Get(roleURL)\nif err != nil { return err }\nvar m map[string]interface{}\nif err := json.Unmarshal(resp.Body, &m); err != nil { return err }\nif c, _ := m[\"Code\"].(string); c != \"Success\" {\n    return fmt.Errorf(\"metadata Code=%q msg=%v\", c, m[\"Message\"])\n}","typeGuard":null,"tryCatchPattern":"// Retry on non-Success Code with backoff; surface the Code/Message to the operator.\nvar creds *stkCredentials\nbackoff := time.Second\nfor attempt := 0; attempt < 5; attempt++ {\n    c, err := refreshEcsStsToken(role)\n    if err == nil { creds = c; break }\n    if strings.Contains(err.Error(), \"Code is not Success\") && attempt < 4 {\n        time.Sleep(backoff); backoff *= 2; continue\n    }\n    return err\n}","preventionTips":["Alert when ECS RAM role detachment occurs so metadata Code flips away from Success.","Keep the RAM role's trust policy scoped to ecs.aliyuncs.com.","Run credential-refresh probes on the ECS host before terraform runs."],"tags":["alibaba-cloud","ecs","sts","iam","ram-role","metadata-service"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}