hashicorp/terraform · error

error getting object: %#v

Error message

error getting object: %#v

What it means

Thrown by the Alibaba Cloud OSS backend's RemoteClient.getObj() (oss/client.go:428) when bucket.GetObject() fails downloading the state file. The prior IsObjectExist check already passed, so the bucket/object resolved but the actual GET returned a non-nil error from the aliyun-oss-go-sdk. It surfaces during any Terraform operation that reads remote state (state pull, plan, apply, refresh). The raw SDK error is formatted with %#v so the concrete *oss.ServiceError is visible.

Source

Thrown at internal/backend/remote-state/oss/client.go:428

	return fmt.Sprintf("%s/%s", c.bucketName, c.stateFile)
}

func (c *RemoteClient) getObj() (*remote.Payload, error) {
	bucket, err := c.ossClient.Bucket(c.bucketName)
	if err != nil {
		return nil, fmt.Errorf("error getting bucket %s: %#v", c.bucketName, err)
	}

	if exist, err := bucket.IsObjectExist(c.stateFile); err != nil {
		return nil, fmt.Errorf("estimating object %s is exist got an error: %#v", c.stateFile, err)
	} else if !exist {
		return nil, nil
	}

	var options []oss.Option
	output, err := bucket.GetObject(c.stateFile, options...)
	if err != nil {
		return nil, fmt.Errorf("error getting object: %#v", err)
	}

	buf := bytes.NewBuffer(nil)
	if _, err := io.Copy(buf, output); err != nil {
		return nil, fmt.Errorf("failed to read remote state: %s", err)
	}
	sum := md5.Sum(buf.Bytes())
	payload := &remote.Payload{
		Data: buf.Bytes(),
		MD5:  sum[:],
	}

	// If there was no data, then return nil
	if len(payload.Data) == 0 {
		return nil, nil
	}

	return payload, nil

View on GitHub (pinned to c9def3e214)

Solutions

1. Wait a minute and re-run the Terraform command (transient OSS/network blips are common and the Get path is not internally retried for this error).
2. Refresh credentials: re-issue the STS token or verify ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET are correct and not expired.
3. Confirm the RAM/IAM principal has oss:GetObject (and oss:ListObjects) on the bucket via the Aliyun console or policy simulator.
4. Double-check bucket, endpoint and region in the backend config match where the state object actually lives.
5. Check Alibaba Cloud OSS status page for a regional outage if the error persists across retries.

Example fix

// before: wrong region/endpoint -> object not reachable
// terraform init -backend-config="endpoint=oss-cn-beijing.aliyuncs.com"

// after: endpoint matches the bucket's region
// terraform init -backend-config="endpoint=oss-cn-hangzhou.aliyuncs.com"

// Pre-flight: confirm the state object is reachable before relying on Get
// ctx := context.Background()
// exists, err := bucket.IsObjectExist(stateFile)
// if err != nil { /* log + abort init */ }
// if !exists { /* first-run, no state yet */ }

// OSS GetObject failures are mostly transient; retry with backoff
// var lastErr error
// for i := 0; i < 3; i++ {
//   payload, diags := client.Get()
//   if !diags.HasErrors() { return payload }
//   lastErr = diags.Err()
//   time.Sleep(time.Duration(1<<i) * time.Second)
// }
// return lastErr

When it happens

Trigger: bucket.GetObject(c.stateFile) returns err: expired or invalid STS/AccessKey credentials, RAM principal lacking oss:GetObject, wrong endpoint/region resolving to a different bucket namespace, the object deleted between IsObjectExist and GetObject, transient OSS gateway/network error, or SDK retry exhaustion.

Common situations: STS token expired mid-CI run; AccessKey scoped without oss:GetObject on the bucket policy; endpoint set to the wrong region so the key namespace mismatches; corporate proxy dropping the HTTPS connection; OSS regional incident.

Related errors

• failed to read remote state: %s
• error getting bucket: %#v
• state data in OSS does not have the expected content. This
• error getting bucket: %#v
• failed to upload state %s: %#v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/b7458fbb186b0cfe. Report an issue: GitHub.