hashicorp/terraform · error

estimating object %s is exist got an error: %#v

Error message

estimating object %s is exist got an error: %#v

What it means

In RemoteClient.getObj() (client.go:419-420), bucket.IsObjectExist(stateFile) failed. IsObjectExist does a HeadObject under the hood; a real OSS service/permission/network error surfaces here (a clean 'does not exist' returns false, not an error). %#v dumps the OSS SDK error.

Source

Thrown at internal/backend/remote-state/oss/client.go:420

		lockErr.Err = err
		return lockErr
	}

	return nil
}

func (c *RemoteClient) lockPath() string {
	return fmt.Sprintf("%s/%s", c.bucketName, c.stateFile)
}

func (c *RemoteClient) getObj() (*remote.Payload, error) {
	bucket, err := c.ossClient.Bucket(c.bucketName)
	if err != nil {
		return nil, fmt.Errorf("error getting bucket %s: %#v", c.bucketName, err)
	}

	if exist, err := bucket.IsObjectExist(c.stateFile); err != nil {
		return nil, fmt.Errorf("estimating object %s is exist got an error: %#v", c.stateFile, err)
	} else if !exist {
		return nil, nil
	}

	var options []oss.Option
	output, err := bucket.GetObject(c.stateFile, options...)
	if err != nil {
		return nil, fmt.Errorf("error getting object: %#v", err)
	}

	buf := bytes.NewBuffer(nil)
	if _, err := io.Copy(buf, output); err != nil {
		return nil, fmt.Errorf("failed to read remote state: %s", err)
	}
	sum := md5.Sum(buf.Bytes())
	payload := &remote.Payload{
		Data: buf.Bytes(),
		MD5:  sum[:],

View on GitHub (pinned to c9def3e214)

Solutions

1. Grant oss:GetObject (and meta read) on arn:acs:oss:*:*:<bucket>/<prefix>/*.
2. Confirm the bucket exists and is in the configured region.
3. Fix host clock skew if %#v shows SignatureDoesNotMatch.
4. Retry after confirming OSS endpoint reachability/proxy egress.

Example fix

// before: policy missing GetObject
//   Action: "oss:PutObject" only
// after:
//   Action: ["oss:GetObject", "oss:PutObject", "oss:DeleteObject"]
//   Resource: "acs:oss:*:*:tf-state/tf-state-prefix/*"

// Pre-check object existence yourself with explicit error handling before terraform refresh.
func stateReadable(bucket *oss.Bucket, key string) error {
    exist, err := bucket.IsObjectExist(key)
    if err != nil {
        return fmt.Errorf("cannot stat %s: %w", key, err)
    }
    if !exist { return nil } // first-run, no state yet
    return nil
}

// Retry on transient HEAD errors; fail fast on AccessDenied/SignatureDoesNotMatch.
if oe, ok := err.(oss.ServiceError); ok {
    if oe.StatusCode >= 500 || oe.StatusCode == 408 { return retry() }
    if oe.StatusCode == 403 { return grantGetObjectPolicy() }
}

When it happens

Trigger: HeadObject returns an error other than 404: AccessDenied (oss:GetObject/Meta), network/timeout, transient 5xx, or signature mismatch. A genuine 'object absent' is handled by the else-if at line 421 returning nil payload, so this error is always an infrastructure/permission fault.

Common situations: RAM policy lacks oss:GetObject or head-style meta permission on the prefix; bucket deleted; OSS regional issue; proxy blocking HEAD requests; clock skew causing SignatureDoesNotMatch on the HEAD.

Related errors

• failed to upload state %s: %#v
• error deleting state %s: %#v
• error getting bucket: %#v
• state data in OSS does not have the expected content. This
• error getting bucket: %#v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c3ad5fbbb2030af6. Report an issue: GitHub.