What causes "Failed to lock cos state: %s" in hashicorp/terraform?

Wait for any in-progress run on that workspace to finish, then re-run `terraform init`.

Failed to lock cos state: %s

Error message

Failed to lock cos state: %s

What it means

Raised in Backend.StateMgr() (cos/backend_state.go:115) while initializing a brand-new workspace. Terraform takes a lock on the freshly-created state before writing the empty initial state; if c.Lock() fails the error is wrapped here. The underlying cause is surfaced in the %s.

Source

Thrown at internal/backend/remote-state/cos/backend_state.go:115

	}

	exists := false
	for _, candidate := range ws {
		if candidate == name {
			exists = true
			break
		}
	}

	if !exists {
		log.Printf("[DEBUG] workspace %v not exists", name)

		// take a lock on this state while we write it
		lockInfo := statemgr.NewLockInfo()
		lockInfo.Operation = "init"
		lockId, err := c.Lock(lockInfo)
		if err != nil {
			return nil, diags.Append(fmt.Errorf("Failed to lock cos state: %s", err))
		}

		// Local helper function so we can call it multiple places
		lockUnlock := func(e error) error {
			if err := stateMgr.Unlock(lockId); err != nil {
				return fmt.Errorf(unlockErrMsg, err, lockId)
			}
			return e
		}

		// Grab the value
		if err := stateMgr.RefreshState(); err != nil {
			err = lockUnlock(err)
			return nil, diags.Append(err)
		}

		// If we have no state, we have to create an empty state
		if v := stateMgr.State(); v == nil {

View on GitHub (pinned to c9def3e214)

Solutions

Wait for any in-progress run on that workspace to finish, then re-run `terraform init`.
Run `terraform force-unlock <lock-id>` to clear a stale lock, using the ID from the error.
Manually delete the leftover lock file object and the tencentcloud-terraform-lock tag, then retry.
Verify the configured credentials have COS object and Tag service permissions.

Example fix

// after seeing 'Failed to lock cos state'
terraform force-unlock <lock-id-from-error>
terraform init

Defensive patterns

Strategy: retry

Validate before calling

// Check for an existing lock before initializing a new workspace
func workspaceLocked(c *remoteClient, lockFile string) bool {
    exists, _, _, _ := c.getObject(lockFile)
    return exists
}

Try / catch

// Retry StateMgr-driven lock acquisition with backoff for transient contention
for attempt := 0; attempt < 5; attempt++ {
    _, diags := b.StateMgr(name)
    if !diags.HasErrors() { break }
    if !strings.Contains(diags.Err().Error(), "Failed to lock cos state") { return diags }
    time.Sleep(time.Duration(attempt+1) * time.Second)
}

Prevention

Avoid concurrent `terraform init` for the same new workspace.
Clear stale locks with `terraform force-unlock` before retrying.
Ensure credentials have COS object and Tag permissions for locking.

When it happens

Trigger: StateMgr() for a workspace that does not yet exist; c.Lock(lockInfo) fails because another process holds the COS lock tag or lock file, or because tag/COS permissions are insufficient.

Common situations: Two concurrent `terraform init` runs creating the same new workspace; a crashed prior run left a lock file/tag; the tag client or COS client lacks permission to create the lock tag.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/419fcd76a3b7e590. Report an issue: GitHub.