hashicorp/terraform · error

get Ecs sts token err : %s

Error message

get Ecs sts token err : %s

What it means

Returned by getAuthCredentialByEcsRoleName when httpClient.Do fails for the GET to the ECS metadata service at 100.100.100.200. This is the network-level failure: the instance cannot reach its own metadata service.

Source

Thrown at internal/backend/remote-state/oss/backend.go:658

// Actually, the job should be done by sdk, but currently not all resources and products support alibaba-cloud-sdk-go,
// and their go sdk does support ecs role name.
// This method is a temporary solution and it should be removed after all go sdk support ecs role name
// The related PR: https://github.com/terraform-providers/terraform-provider-alicloud/pull/731
func getAuthCredentialByEcsRoleName(ecsRoleName string) (accessKey, secretKey, token string, err error) {

	if ecsRoleName == "" {
		return
	}
	requestUrl := securityCredURL + ecsRoleName
	httpRequest, err := http.NewRequest(requests.GET, requestUrl, strings.NewReader(""))
	if err != nil {
		err = fmt.Errorf("build sts requests err: %s", err.Error())
		return
	}
	httpClient := &http.Client{}
	httpResponse, err := httpClient.Do(httpRequest)
	if err != nil {
		err = fmt.Errorf("get Ecs sts token err : %s", err.Error())
		return
	}

	response := responses.NewCommonResponse()
	err = responses.Unmarshal(response, httpResponse, "")
	if err != nil {
		err = fmt.Errorf("unmarshal Ecs sts token response err : %s", err.Error())
		return
	}

	if response.GetHttpStatus() != http.StatusOK {
		err = fmt.Errorf("get Ecs sts token err, httpStatus: %d, message = %s", response.GetHttpStatus(), response.GetHttpContentString())
		return
	}
	var data interface{}
	err = json.Unmarshal(response.GetHttpContentBytes(), &data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, json.Unmarshal fail: %s", err.Error())

View on GitHub (pinned to c9def3e214)

Solutions

  1. Only set ecs_role_name when running on an Alibaba Cloud ECS instance with the RAM role attached.
  2. If running elsewhere, remove ecs_role_name and provide access_key/secret_key (or security_token) instead.
  3. On the instance, verify reachability: curl http://100.100.100.200/latest/meta-data/ from a shell.
  4. Ensure no local firewall/iptables blocks the 169.254/100.100 link-local range.

Example fix

# before: ecs_role_name set on a non-ECS host
ecs_role_name = "my-ram-role"

# after: use static creds off-ECS
access_key = "LTAI..."
secret_key = "abc..."
# (remove ecs_role_name)
Defensive patterns

Strategy: validation

Validate before calling

func isOnECS() bool {
    resp, err := http.Get("http://100.100.100.200/latest/meta-data/")
    return err == nil && resp.StatusCode == 200
}

Try / catch

if _, err := getAuthCredentialByEcsRoleName(role); err != nil {
    if strings.Contains(err.Error(), "get Ecs sts token err") {
        // not on ECS, or metadata blocked -> use static creds
        return staticCreds()
    }
    return err
}

Prevention

When it happens

Trigger: The code is NOT actually running on an Alibaba Cloud ECS instance (so 100.100.100.200 is unreachable); the metadata service is blocked by a custom network namespace/iptables; ECS instance is in a broken/stopped state; tight firewall rules dropping link-local traffic.

Common situations: Setting ecs_role_name on a local dev machine or non-Alibaba VM; running in a container with host network disabled; misconfigured VPC/security group blocking metadata; instance hibernation.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/88e6c3c9c8a4c47e. Report an issue: GitHub.