{"record":{"id":"ee564105959d0577","repo":"hashicorp/terraform","slug":"refresh-ecs-sts-token-err-code-is-not-success","errorCode":null,"errorMessage":"refresh Ecs sts token err, Code is not Success","messagePattern":"refresh Ecs sts token err, Code is not Success","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":685,"sourceCode":"\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())\n\t\treturn\n\t}\n\tvar data interface{}\n\terr = json.Unmarshal(response.GetHttpContentBytes(), &data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, json.Unmarshal fail: %s\", err.Error())\n\t\treturn\n\t}\n\tcode, err := jmespath.Search(\"Code\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get Code: %s\", err.Error())\n\t\treturn\n\t}\n\tif code.(string) != \"Success\" {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, Code is not Success\")\n\t\treturn\n\t}\n\taccessKeyId, err := jmespath.Search(\"AccessKeyId\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeyId: %s\", err.Error())\n\t\treturn\n\t}\n\taccessKeySecret, err := jmespath.Search(\"AccessKeySecret\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get AccessKeySecret: %s\", err.Error())\n\t\treturn\n\t}\n\tsecurityToken, err := jmespath.Search(\"SecurityToken\", data)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"refresh Ecs sts token err, fail to get SecurityToken: %s\", err.Error())\n\t\treturn\n\t}\n","sourceCodeStart":667,"sourceCodeEnd":703,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L667-L703","documentation":"Returned by getAuthCredentialByEcsRoleName when the metadata JSON parsed correctly, the 'Code' field was found, but its value is not the string \"Success\". The Alibaba Cloud metadata API uses Code to signal outcome; a non-Success code means the credential request was logically rejected (even though HTTP was 200).","triggerScenarios":"The metadata service returns 200 with a body like {\"Code\":\"InvalidRamRole\",\"Message\":\"...\"}. Common codes include the role not being authorized, the instance not being allowed to assume it, or a transient metadata error code.","commonSituations":"RAM role trust policy does not allow the ECS service principal; role deleted or disabled after attachment; cross-account role misconfiguration; transient metadata error code during a regional incident.","solutions":["In RAM, edit the role's trust policy to trust ecs.aliyuncs.com as the principal.","Confirm the role still exists and is enabled.","curl the metadata URL and read the \"Message\"/\"Code\" field for the exact reason.","Retry for transient codes; fall back to static/STS creds if persistent."],"exampleFix":"# before: role exists but trust policy excludes ECS\n# metadata returns {\"Code\":\"NoPermission\"}\necs_role_name = \"app-role\"\n\n# after: update role trust policy to allow ECS, then\n# metadata returns {\"Code\":\"Success\",\"AccessKeyId\":...}\necs_role_name = \"app-role\"","handlingStrategy":"validation","validationCode":"func metadataCodeSuccess(role string) error {\n    u := \"http://100.100.100.200/latest/meta-data/ram/security-credentials/\" + role\n    resp, err := http.Get(u)\n    if err != nil { return err }\n    defer resp.Body.Close()\n    var m map[string]interface{}\n    json.NewDecoder(resp.Body).Decode(&m)\n    if c, _ := m[\"Code\"].(string); c != \"Success\" {\n        return fmt.Errorf(\"metadata Code=%v Message=%v\", m[\"Code\"], m[\"Message\"])\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := getAuthCredentialByEcsRoleName(role); err != nil {\n    if strings.Contains(err.Error(), \"Code is not Success\") {\n        return fmt.Errorf(\"RAM role %q not authorized for ECS; check trust policy: %w\", role, err)\n    }\n    return err\n}","preventionTips":["Ensure the role's trust policy trusts ecs.aliyuncs.com.","Keep the role enabled and present in the right account/region.","Read the Message field of the metadata envelope for the exact reason."],"tags":["oss","ecs","metadata","auth","ram-role","authorization","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}