{"record":{"id":"f5392bb99f787b71","repo":"hashicorp/terraform","slug":"build-sts-requests-err-s","errorCode":null,"errorMessage":"build sts requests err: %s","messagePattern":"build sts requests err: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":652,"sourceCode":"\treturn providerConfig[ProfileKey], nil\n}\n\nvar securityCredURL = \"http://100.100.100.200/latest/meta-data/ram/security-credentials/\"\n\n// getAuthCredentialByEcsRoleName aims to access meta to get sts credential\n// Actually, the job should be done by sdk, but currently not all resources and products support alibaba-cloud-sdk-go,\n// and their go sdk does support ecs role name.\n// This method is a temporary solution and it should be removed after all go sdk support ecs role name\n// The related PR: https://github.com/terraform-providers/terraform-provider-alicloud/pull/731\nfunc getAuthCredentialByEcsRoleName(ecsRoleName string) (accessKey, secretKey, token string, err error) {\n\n\tif ecsRoleName == \"\" {\n\t\treturn\n\t}\n\trequestUrl := securityCredURL + ecsRoleName\n\thttpRequest, err := http.NewRequest(requests.GET, requestUrl, strings.NewReader(\"\"))\n\tif err != nil {\n\t\terr = fmt.Errorf(\"build sts requests err: %s\", err.Error())\n\t\treturn\n\t}\n\thttpClient := &http.Client{}\n\thttpResponse, err := httpClient.Do(httpRequest)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"get Ecs sts token err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tresponse := responses.NewCommonResponse()\n\terr = responses.Unmarshal(response, httpResponse, \"\")\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unmarshal Ecs sts token response err : %s\", err.Error())\n\t\treturn\n\t}\n\n\tif response.GetHttpStatus() != http.StatusOK {\n\t\terr = fmt.Errorf(\"get Ecs sts token err, httpStatus: %d, message = %s\", response.GetHttpStatus(), response.GetHttpContentString())","sourceCodeStart":634,"sourceCodeEnd":670,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L634-L670","documentation":"Returned by getAuthCredentialByEcsRoleName when http.NewRequest fails to build the GET request to the ECS metadata service (http://100.100.100.200/latest/meta-data/ram/security-credentials/<role>). This is a request-construction error, not a network error — it indicates a malformed URL or HTTP library issue.","triggerScenarios":"ecs_role_name contains characters that break URL parsing (spaces, control chars), or the securityCredURL constant + role name produces an invalid URL that net/http refuses to build. Extremely rare in practice since the URL is fixed.","commonSituations":"ecs_role_name sourced from an env var with trailing whitespace/newline; misconfigured ALIBABA_CLOUD_ECS_METADATA; exotic role names with reserved characters.","solutions":["Trim whitespace from ecs_role_name / ALIBABA_CLOUD_ECS_METADATA.","Use a role name containing only alphanumerics, hyphens, and underscores.","If not running on Alibaba Cloud ECS, do not set ecs_role_name — use static or STS credentials instead."],"exampleFix":"# before\necs_role_name = \"my-role\\n\"   # trailing newline breaks URL parse\n\n# after\necs_role_name = \"my-role\"","handlingStrategy":"validation","validationCode":"func sanitizeRoleName(r string) (string, error) {\n    r = strings.TrimSpace(r)\n    if !regexp.MustCompile(`^[A-Za-z0-9._-]+$`).MatchString(r) {\n        return \"\", fmt.Errorf(\"invalid ecs_role_name: %q\", r)\n    }\n    return r, nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim whitespace from role names.","Keep role names alphanumeric + hyphen/underscore.","Don't set ecs_role_name off-ECS."],"tags":["oss","ecs","metadata","auth","url","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}