hashicorp/terraform · warning

describe oss endpoint using region: %#v got an error: %#v

Error message

describe oss endpoint using region: %#v got an error: %#v

What it means

Returned by getOSSEndpointByRegion when locationClient.DescribeEndpoints returns an error while querying the Alibaba Cloud Location service (location-readonly.aliyuncs.com) for the OSS endpoint of the given region. The %#v shows both the region and the SDK error.

Source

Thrown at internal/backend/remote-state/oss/backend.go:458

	return err
}

func (b *Backend) getOSSEndpointByRegion(access_key, secret_key, security_token, region string) (*location.DescribeEndpointsResponse, error) {
	args := location.CreateDescribeEndpointsRequest()
	args.ServiceCode = "oss"
	args.Id = region
	args.Domain = "location-readonly.aliyuncs.com"

	locationClient, err := location.NewClientWithOptions(region, getSdkConfig(), credentials.NewStsTokenCredential(access_key, secret_key, security_token))
	if err != nil {
		return nil, fmt.Errorf("unable to initialize the location client: %#v", err)

	}
	locationClient.AppendUserAgent(TerraformUA, TerraformVersion)
	endpointsResponse, err := locationClient.DescribeEndpoints(args)
	if err != nil {
		return nil, fmt.Errorf("describe oss endpoint using region: %#v got an error: %#v", region, err)
	}
	return endpointsResponse, nil
}

func getAssumeRoleAK(accessKey, secretKey, stsToken, region, roleArn, sessionName, policy, stsEndpoint string, sessionExpiration int) (string, string, string, error) {
	request := sts.CreateAssumeRoleRequest()
	request.RoleArn = roleArn
	request.RoleSessionName = sessionName
	request.DurationSeconds = requests.NewInteger(sessionExpiration)
	request.Policy = policy
	request.Scheme = "https"

	var client *sts.Client
	var err error
	if stsToken == "" {
		client, err = sts.NewClientWithAccessKey(region, accessKey, secretKey)
	} else {
		client, err = sts.NewClientWithStsToken(region, accessKey, secretKey, stsToken)

View on GitHub (pinned to c9def3e214)

Solutions

1. Set an explicit endpoint in the backend block (endpoint = "oss-cn-hangzhou.aliyuncs.com") to bypass Location discovery entirely.
2. Verify network egress to location-readonly.aliyuncs.com (and the OSS domain) is allowed by proxies/firewalls.
3. Refresh credentials if the wrapped error indicates auth failure (InvalidAccessKeyId / SecurityTokenExpired).
4. Accept the fallback: configure() logs a WARN and uses oss-<region>.aliyuncs.com, which is usually correct.

Example fix

# before: relies on Location discovery that is blocked by proxy
region = "cn-hangzhou"

# after: pin the endpoint
region   = "cn-hangzhou"
endpoint = "oss-cn-hangzhou.aliyuncs.com"

// Pre-resolve the endpoint to skip Location discovery entirely.
func resolveEndpoint(region, explicit string) string {
    if explicit != "" { return explicit }
    if region == "" { return "" }
    return fmt.Sprintf("oss-%s.aliyuncs.com", region)
}

// configure() already treats this as a WARN and falls back.
if _, err := b.getOSSEndpointByRegion(ak, sk, tok, region); err != nil {
    endpoint = fmt.Sprintf("oss-%s.aliyuncs.com", region)
}

When it happens

Trigger: DescribeEndpoints API call fails: invalid/expired credentials, region unknown to the Location service, network/proxy blocking location-readonly.aliyuncs.com, or the Location service itself returning an error. Note configure() catches this as a WARN and falls back to oss-<region>.aliyuncs.com, so it is usually non-fatal.

Common situations: Corporate egress proxy blocking the Location domain; transient Location service outage; using a new/isolated region not yet in the Location catalog; stale STS token.

Related errors

• unable to initialize the location client: %#v
• get Ecs sts token err : %s
• unmarshal Ecs sts token response err : %s
• refresh Ecs sts token err, json.Unmarshal fail: %s
• consul lock was lost

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/5ada72864d11c620. Report an issue: GitHub.