hashicorp/terraform · error

Connection Error: StatusCode: %d

Error message

Connection Error: StatusCode: %d

What it means

Raised in proxyDialer.Dial when the HTTP proxy returns a non-200 status code in response to the CONNECT request used to tunnel the SSH connection. The communicator issues an HTTP CONNECT to the proxy and expects 200 OK; any other status (407, 403, 502, etc.) produces this error with the raw status code.

Source

Thrown at internal/communicator/ssh/http_proxy.go:111

	// Writes the request in the form expected by an HTTP proxy.
	err = req.Write(c)
	if err != nil {
		c.Close()
		return nil, err
	}

	res, err := http.ReadResponse(bufio.NewReader(c), req)

	if err != nil {
		c.Close()
		return nil, err
	}

	res.Body.Close()

	if res.StatusCode != http.StatusOK {
		c.Close()
		return nil, fmt.Errorf("Connection Error: StatusCode: %d", res.StatusCode)
	}

	return c, nil
}

// NewHttpProxyDialer generate Http Proxy Dialer
func newHttpProxyDialer(u *url.URL, forward proxy.Dialer) (proxy.Dialer, error) {
	var proxyUserName, proxyPassword string
	if u.User != nil {
		proxyUserName = u.User.Username()
		proxyPassword, _ = u.User.Password()
	}

	pd := &proxyDialer{
		proxy:   *newProxyInfo(u.Host, u.Scheme, proxyUserName, proxyPassword),
		forward: forward,
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Match the status code: 407 means add/fix proxy_user_name and proxy_user_password; 403 means the proxy ACL blocks the target; 502/503 means upstream/proxy issue.
2. Verify proxy credentials are correct and the proxy allows CONNECT to the target host and port.
3. Test the proxy manually: curl -v -x http://user:pass@proxy:port --proxytunnel target:22.
4. If using a corporate proxy, confirm the target host/port is in the proxy's allowed CONNECT list.

Example fix

// before
connection {
  proxy_host = var.proxy
  proxy_port = 3128
}

// after
connection {
  proxy_host         = var.proxy
  proxy_port         = 3128
  proxy_user_name    = var.proxy_user
  proxy_user_password = var.proxy_pass
}

// Validate proxy CONNECT returns 200 before the full terraform run
func validateProxyConnect(proxyHost, proxyPort, proxyUser, proxyPass, targetAddr string) error {
    proxyURL := fmt.Sprintf("http://%s:%s@%s:%d", proxyUser, proxyPass, proxyHost, proxyPort)
    u, _ := url.Parse(proxyURL)
    dialer, err := proxy.FromURL(u, proxy.Direct)
    if err != nil {
        return err
    }
    conn, err := dialer.Dial("tcp", targetAddr)
    if err != nil {
        return fmt.Errorf("proxy CONNECT failed: %w", err)
    }
    conn.Close()
    return nil
}

// Interpret HTTP proxy status codes to guide remediation
if err := comm.Connect(o); err != nil {
    if strings.Contains(err.Error(), "Connection Error: StatusCode: 407") {
        return errors.New("proxy requires authentication — set proxy_user_name and proxy_user_password")
    }
    if strings.Contains(err.Error(), "Connection Error: StatusCode: 403") {
        return errors.New("proxy forbids CONNECT to this host — check proxy ACL")
    }
    return err
}

When it happens

Trigger: The proxy server rejected the CONNECT tunnel: 407 Proxy Authentication Required (missing/wrong credentials), 403 Forbidden (ACL policy), 502/503 (proxy cannot reach upstream), or the proxy does not allow CONNECT to the target host/port.

Common situations: proxy_user_name or proxy_user_password is wrong or missing (407), the proxy has an allowlist that excludes the target host (403), the proxy is overloaded or the upstream is down (502/503), or the proxy does not support tunneling to non-standard ports.

Related errors

• Error connecting to proxy: %s
• %s returned an unexpected error: %s
• Error creating new client connection via proxy: %s
• Error connecting to bastion: %s
• operation timed out

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/2279bcc6a9c26d0a. Report an issue: GitHub.