hashicorp/terraform · error

refresh Ecs sts token err, Code is not Success

Error message

refresh Ecs sts token err, Code is not Success

What it means

Returned by getAuthCredentialByEcsRoleName when the metadata JSON parsed correctly, the 'Code' field was found, but its value is not the string "Success". The Alibaba Cloud metadata API uses Code to signal outcome; a non-Success code means the credential request was logically rejected (even though HTTP was 200).

Source

Thrown at internal/backend/remote-state/oss/backend.go:685

	}

	if response.GetHttpStatus() != http.StatusOK {
		err = fmt.Errorf("get Ecs sts token err, httpStatus: %d, message = %s", response.GetHttpStatus(), response.GetHttpContentString())
		return
	}
	var data interface{}
	err = json.Unmarshal(response.GetHttpContentBytes(), &data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, json.Unmarshal fail: %s", err.Error())
		return
	}
	code, err := jmespath.Search("Code", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get Code: %s", err.Error())
		return
	}
	if code.(string) != "Success" {
		err = fmt.Errorf("refresh Ecs sts token err, Code is not Success")
		return
	}
	accessKeyId, err := jmespath.Search("AccessKeyId", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get AccessKeyId: %s", err.Error())
		return
	}
	accessKeySecret, err := jmespath.Search("AccessKeySecret", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get AccessKeySecret: %s", err.Error())
		return
	}
	securityToken, err := jmespath.Search("SecurityToken", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get SecurityToken: %s", err.Error())
		return
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. In RAM, edit the role's trust policy to trust ecs.aliyuncs.com as the principal.
2. Confirm the role still exists and is enabled.
3. curl the metadata URL and read the "Message"/"Code" field for the exact reason.
4. Retry for transient codes; fall back to static/STS creds if persistent.

Example fix

# before: role exists but trust policy excludes ECS
# metadata returns {"Code":"NoPermission"}
ecs_role_name = "app-role"

# after: update role trust policy to allow ECS, then
# metadata returns {"Code":"Success","AccessKeyId":...}
ecs_role_name = "app-role"

func metadataCodeSuccess(role string) error {
    u := "http://100.100.100.200/latest/meta-data/ram/security-credentials/" + role
    resp, err := http.Get(u)
    if err != nil { return err }
    defer resp.Body.Close()
    var m map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&m)
    if c, _ := m["Code"].(string); c != "Success" {
        return fmt.Errorf("metadata Code=%v Message=%v", m["Code"], m["Message"])
    }
    return nil
}

if _, err := getAuthCredentialByEcsRoleName(role); err != nil {
    if strings.Contains(err.Error(), "Code is not Success") {
        return fmt.Errorf("RAM role %q not authorized for ECS; check trust policy: %w", role, err)
    }
    return err
}

When it happens

Trigger: The metadata service returns 200 with a body like {"Code":"InvalidRamRole","Message":"..."}. Common codes include the role not being authorized, the instance not being allowed to assume it, or a transient metadata error code.

Common situations: RAM role trust policy does not allow the ECS service principal; role deleted or disabled after attachment; cross-account role misconfiguration; transient metadata error code during a regional incident.

Related errors

• get Ecs sts token err, httpStatus: %d, message = %s
• build sts requests err: %s
• get Ecs sts token err : %s
• unmarshal Ecs sts token response err : %s
• refresh Ecs sts token err, json.Unmarshal fail: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/ee564105959d0577. Report an issue: GitHub.