{"record":{"id":"f9e49900a4a7983a","repo":"hashicorp/terraform","slug":"failed-to-s-v","errorCode":null,"errorMessage":"Failed to %s: %v","messagePattern":"Failed to (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/http/client.go","lineNumber":74,"sourceCode":"\tif c.Username != \"\" {\n\t\treq.SetBasicAuth(c.Username, c.Password)\n\t}\n\n\t// Work with data/body\n\tif data != nil {\n\t\treq.Header.Set(\"Content-Type\", \"application/json\")\n\t\treq.ContentLength = int64(len(*data))\n\n\t\t// Generate the MD5\n\t\thash := md5.Sum(*data)\n\t\tb64 := base64.StdEncoding.EncodeToString(hash[:])\n\t\treq.Header.Set(\"Content-MD5\", b64)\n\t}\n\n\t// Make the request\n\tresp, err := c.Client.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to %s: %v\", what, err)\n\t}\n\n\treturn resp, nil\n}\n\nfunc (c *httpClient) Lock(info *statemgr.LockInfo) (string, error) {\n\tif c.LockURL == nil {\n\t\treturn \"\", nil\n\t}\n\tc.lockID = \"\"\n\n\tjsonLockInfo := info.Marshal()\n\tresp, err := c.httpRequest(c.LockMethod, c.LockURL, &jsonLockInfo, \"lock\")\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer resp.Body.Close()\n","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/http/client.go#L56-L92","documentation":"c.Client.Do(req) failed — the request was built but the actual HTTP round-trip errored. retryablehttp will already have retried up to retry_max times with backoff between retry_wait_min and retry_wait_max, so this surfaces only after all retries are exhausted. Causes include DNS resolution failure, connection refused/timeout, TLS handshake errors, or a broken pipe mid-stream.","triggerScenarios":"State endpoint host is unreachable, DNS NXDOMAIN, TCP connection refused (server down), TLS certificate validation failure when skip_cert_verification is false, proxy misconfiguration, or network partition. Fires on Get/Put/Delete/Lock/Unlock.","commonSituations":"VPN not connected when running terraform locally; state server behind a private IP not reachable from CI; cert expired or signed by an unknown CA; corporate proxy environment variables not honored; transient outage during a long apply.","solutions":["Check connectivity: `curl -v <address>` from the same host/CI runner where terraform runs.","Verify DNS resolves: `getent hosts <hostname>` or `dig +short <hostname>`.","If TLS validation fails, either install the CA via client_ca_certificate_pem or, only for trusted internal CAs, set skip_cert_verification = true (avoid in production).","Raise retry_max and retry_wait_max to better tolerate transient outages.","Confirm HTTP_PROXY/HTTPS_PROXY/NO_PROXY are set correctly for your network."],"exampleFix":"// before\nbackend \"http\" {\n  address       = \"https://state.corp/state\"\n  retry_max     = 0\n}\n// after\nbackend \"http\" {\n  address        = \"https://state.corp/state\"\n  retry_max      = 4\n  retry_wait_min = 1\n  retry_wait_max = 30\n}","handlingStrategy":"retry","validationCode":"// Pre-flight connectivity check before terraform runs\nimport (\n  \"fmt\"\n  \"net\"\n  \"net/url\"\n  \"time\"\n)\nfunc preflightReachable(raw string) error {\n  u, err := url.Parse(raw)\n  if err != nil { return err }\n  host := u.Hostname()\n  if _, ok := u.Port(\"\"); ok { host = net.JoinHostPort(host, u.Port()) }\n  c, err := net.DialTimeout(\"tcp\", host, 5*time.Second)\n  if err != nil { return fmt.Errorf(\"cannot reach state host: %w\", err) }\n  c.Close()\n  return nil\n}","typeGuard":null,"tryCatchPattern":"// Wrap state ops with bounded retry; distinguish transport errors from business errors.\nfor attempt := 0; attempt < maxAttempts; attempt++ {\n  err = runTerraform()\n  if err == nil { break }\n  if isTransportErr(err) && attempt < maxAttempts-1 {\n    backoff.Sleep(); continue\n  }\n  return err\n}","preventionTips":["Run `terraform init`/`plan` from environments with verified network reach to the state server.","Tune retry_max/retry_wait_max to absorb known transient outages.","Set HTTPS_PROXY/NO_PROXY correctly for the network.","Monitor the state endpoint's availability as part of pipeline pre-checks."],"tags":["network","retry-exhausted","http-backend","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}