{"record":{"id":"fc371d6669bdfdfd","repo":"hashicorp/terraform","slug":"failed-to-upload-part-d-w","errorCode":null,"errorMessage":"failed to upload part %d: %w","messagePattern":"failed to upload part (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/multipart_upload.go","lineNumber":241,"sourceCode":"\t\t\tUploadPartBody: io.NopCloser(bytes.NewReader(buffer)),\n\t\t\tUploadPartNum:  block.blockNumber,\n\t\t\tContentMD5:     common.String(base64.StdEncoding.EncodeToString(sum[:])),\n\t\t\tRequestMetadata: common.RequestMetadata{\n\t\t\t\tRetryPolicy: getDefaultRetryPolicy(),\n\t\t\t},\n\t\t}\n\n\t\tif ctx.client.kmsKeyID != \"\" {\n\t\t\tuploadPartRequest.OpcSseKmsKeyId = common.String(ctx.client.kmsKeyID)\n\t\t} else if ctx.client.SSECustomerKey != \"\" && ctx.client.SSECustomerKeySHA256 != \"\" {\n\t\t\tuploadPartRequest.OpcSseCustomerKey = common.String(ctx.client.SSECustomerKey)\n\t\t\tuploadPartRequest.OpcSseCustomerKeySha256 = common.String(ctx.client.SSECustomerKeySHA256)\n\t\t\tuploadPartRequest.OpcSseCustomerAlgorithm = common.String(ctx.client.SSECustomerAlgorithm)\n\t\t}\n\n\t\tresponse, err := ctx.client.objectStorageClient.UploadPart(context.Background(), *uploadPartRequest)\n\t\tif err != nil {\n\t\t\tctx.errChan <- fmt.Errorf(\"failed to upload part %d: %w\", *block.blockNumber, err)\n\t\t\treturn\n\t\t}\n\t\tctx.osUploadPartResponses <- objectStorageUploadPartResponse{\n\t\t\tresponse:   response,\n\t\t\terror:      nil,\n\t\t\tpartNumber: block.blockNumber,\n\t\t}\n\t\tctx.wg.Done()\n\n\t}\n}\n","sourceCodeStart":223,"sourceCodeEnd":253,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oci/multipart_upload.go#L223-L253","documentation":"Thrown by a worker goroutine inside multiPartUploadImpl when the OCI object storage UploadPart API call fails for a single chunk of a multipart upload. The %d is the 1-based part number and %w wraps the underlying SDK/network error. Because up to 10 concurrent workers run, one failing part aborts the whole upload via the worker returning early on the error channel.","triggerScenarios":"A call to multiPartUploadImpl whose source data exceeds 128MB (DefaultFilePartSize) so it is split into parts; UploadPart (oci objectstorage) returns a non-nil error for one chunk. Causes: expired STS/OAuth token, SSE-KMS/SSE-C key mismatch on a part, network reset mid-stream, bucket not found, quota/rate-limit, or ContentMD5 mismatch detected server-side.","commonSituations":"Running terraform init/apply with the oci backend on a large state file over an unstable link; rotating OCI credentials mid-run; specifying an SSECustomerKey that does not match the bucket's server-side encryption config; exceeding the object-storage request rate limit on a shared tenancy.","solutions":["Inspect the wrapped error (the %w) — it is the real cause; fix that (auth, network, KMS key) before retrying.","Verify the SSE settings: if the bucket uses a customer-provided key, ensure SSECustomerKey, SSECustomerKeySHA256 and SSECustomerAlgorithm are all set and consistent, or use kmsKeyId instead.","Confirm the OCI credentials/region in the config are still valid and the namespace/bucket names are correct.","Retry the operation on a stable network; the per-part request already carries getDefaultRetryPolicy() so transient blips are retried automatically — a surfaced error means retries were exhausted.","If the file is near the 10000-part / 50GB-part limits, raise DefaultFilePartSize via the OSS client if the data is huge."],"exampleFix":"// before: mismatched SSE config\nclient.SSECustomerKey = key\n// SSECustomerKeySHA256 left unset -> part upload fails\n\n// after: provide the SHA256 (base64 of the raw key hash) consistently\nclient.SSECustomerKey = key\nclient.SSECustomerKeySHA256 = base64.StdEncoding.EncodeToString(sha256sum)\nclient.SSECustomerAlgorithm = \"AES256\"","handlingStrategy":"retry","validationCode":"// Before launching a large upload, confirm creds + SSE config are consistent.\nfunc validateOCIClient(c *RemoteClient) error {\n    if c.bucketName == \"\" || c.namespace == \"\" {\n        return fmt.Errorf(\"oci client missing bucket/namespace\")\n    }\n    if (c.SSECustomerKey != \"\") != (c.SSECustomerKeySHA256 != \"\") {\n        return fmt.Errorf(\"SSE-C requires both SSECustomerKey and SSECustomerKeySHA256\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Wrap multiPartUploadImpl; surface the wrapped part error, retry idempotently.\nerr := uploadData.multiPartUploadImpl(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to upload part\") {\n    // part uploads are idempotent (ContentMD5 set); safe to retry the whole upload\n    return uploadData.multiPartUploadImpl(ctx)\n}","preventionTips":["Keep SSE-C fields (key, sha256, algorithm) all set together or all empty.","Use stable, low-latency connectivity for large state files.","Refresh OCI tokens before long runs."],"tags":["oci","object-storage","multipart-upload","network","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}