hashicorp/terraform · error

build sts requests err: %s

Error message

build sts requests err: %s

What it means

Returned by getAuthCredentialByEcsRoleName when http.NewRequest fails to build the GET request to the ECS metadata service (http://100.100.100.200/latest/meta-data/ram/security-credentials/<role>). This is a request-construction error, not a network error — it indicates a malformed URL or HTTP library issue.

Source

Thrown at internal/backend/remote-state/oss/backend.go:652

	return providerConfig[ProfileKey], nil
}

var securityCredURL = "http://100.100.100.200/latest/meta-data/ram/security-credentials/"

// getAuthCredentialByEcsRoleName aims to access meta to get sts credential
// Actually, the job should be done by sdk, but currently not all resources and products support alibaba-cloud-sdk-go,
// and their go sdk does support ecs role name.
// This method is a temporary solution and it should be removed after all go sdk support ecs role name
// The related PR: https://github.com/terraform-providers/terraform-provider-alicloud/pull/731
func getAuthCredentialByEcsRoleName(ecsRoleName string) (accessKey, secretKey, token string, err error) {

	if ecsRoleName == "" {
		return
	}
	requestUrl := securityCredURL + ecsRoleName
	httpRequest, err := http.NewRequest(requests.GET, requestUrl, strings.NewReader(""))
	if err != nil {
		err = fmt.Errorf("build sts requests err: %s", err.Error())
		return
	}
	httpClient := &http.Client{}
	httpResponse, err := httpClient.Do(httpRequest)
	if err != nil {
		err = fmt.Errorf("get Ecs sts token err : %s", err.Error())
		return
	}

	response := responses.NewCommonResponse()
	err = responses.Unmarshal(response, httpResponse, "")
	if err != nil {
		err = fmt.Errorf("unmarshal Ecs sts token response err : %s", err.Error())
		return
	}

	if response.GetHttpStatus() != http.StatusOK {
		err = fmt.Errorf("get Ecs sts token err, httpStatus: %d, message = %s", response.GetHttpStatus(), response.GetHttpContentString())

View on GitHub (pinned to c9def3e214)

Solutions

1. Trim whitespace from ecs_role_name / ALIBABA_CLOUD_ECS_METADATA.
2. Use a role name containing only alphanumerics, hyphens, and underscores.
3. If not running on Alibaba Cloud ECS, do not set ecs_role_name — use static or STS credentials instead.

Example fix

# before
ecs_role_name = "my-role\n"   # trailing newline breaks URL parse

# after
ecs_role_name = "my-role"

func sanitizeRoleName(r string) (string, error) {
    r = strings.TrimSpace(r)
    if !regexp.MustCompile(`^[A-Za-z0-9._-]+$`).MatchString(r) {
        return "", fmt.Errorf("invalid ecs_role_name: %q", r)
    }
    return r, nil
}

When it happens

Trigger: ecs_role_name contains characters that break URL parsing (spaces, control chars), or the securityCredURL constant + role name produces an invalid URL that net/http refuses to build. Extremely rare in practice since the URL is fixed.

Common situations: ecs_role_name sourced from an env var with trailing whitespace/newline; misconfigured ALIBABA_CLOUD_ECS_METADATA; exotic role names with reserved characters.

Related errors

• get Ecs sts token err : %s
• unmarshal Ecs sts token response err : %s
• get Ecs sts token err, httpStatus: %d, message = %s
• refresh Ecs sts token err, json.Unmarshal fail: %s
• refresh Ecs sts token err, fail to get Code: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/f5392bb99f787b71. Report an issue: GitHub.