there is no any available accesskey, secret and security tok

Error message

there is no any available accesskey, secret and security token for Ecs role %s

What it means

Final guard in getAuthCredentialByEcsRoleName (backend.go:704): all three JMESPath lookups returned nil error, but at least one of accessKeyId/accessKeySecret/securityToken is nil. I.e. the metadata service returned Code=="Success" with no actual credential values. This is a role-authorization failure rather than a parsing failure.

Source

Thrown at internal/backend/remote-state/oss/backend.go:705

	}
	accessKeyId, err := jmespath.Search("AccessKeyId", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get AccessKeyId: %s", err.Error())
		return
	}
	accessKeySecret, err := jmespath.Search("AccessKeySecret", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get AccessKeySecret: %s", err.Error())
		return
	}
	securityToken, err := jmespath.Search("SecurityToken", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get SecurityToken: %s", err.Error())
		return
	}

	if accessKeyId == nil || accessKeySecret == nil || securityToken == nil {
		err = fmt.Errorf("there is no any available accesskey, secret and security token for Ecs role %s", ecsRoleName)
		return
	}

	return accessKeyId.(string), accessKeySecret.(string), securityToken.(string), nil
}

func getHttpProxyUrl(rawUrl string) (*url.URL, error) {
	pc := httpproxy.FromEnvironment()
	u, err := url.Parse(rawUrl)
	if err != nil {
		return nil, err
	}
	return pc.ProxyFunc()(u)
}

View on GitHub (pinned to c9def3e214)

Solutions

Confirm ecs_role_name in the backend block exactly matches the RAM role currently attached to the ECS instance.
In the RAM console, verify the role's trust policy trusts the ECS service principal ("acs:ecs:*").
Attach a system or custom policy to the role granting the needed OSS/TableStore permissions so credentials are actually issued.
Run terraform from a host with explicit AK/SK credentials if the role-attached metadata path cannot be fixed.

Example fix

// before
backend "oss" {
  bucket = "tf-state"
  ecs_role_name = "TfRole"   // typo / case mismatch
}

// after
backend "oss" {
  bucket = "tf-state"
  ecs_role_name = "tf-role"  // exact RAM role name
}

Defensive patterns

Strategy: validation

Validate before calling

// Verify the role name resolves and yields a full credential triple before terraform runs.
func validateEcsRole(role string) error {
    ak, sk, tok, err := getAuthCredentialByEcsRoleName(role)
    if err != nil {
        return err
    }
    if ak == "" || sk == "" || tok == "" {
        return fmt.Errorf("role %s issued incomplete credentials", role)
    }
    return nil
}

Try / catch

// Not retryable; it's an authorization outcome. Surface to the user and stop.
if err != nil && strings.Contains(err.Error(), "no any available accesskey") {
    return fmt.Errorf("RAM role %q not authorized for STS; check trust + permission policies", role)
}

Prevention

Cross-check ecs_role_name spelling against the RAM console exactly (case-sensitive).
Attach an Aliyun-managed policy (e.g. AliyunOSSFullAccess) to the role so credentials are actually granted.
In the role trust policy, trust the ECS service principal, not a generic RAM principal.

When it happens

Trigger: JMESPath searches all succeed (nil error) but yield nil values, so the conditional at line 704 trips. Happens when the RAM role attached to the instance is not the one expected, or the role has no permission to mint credentials for this principal, yet the metadata endpoint still answers Success.

Common situations: Wrong ecs_role_name configured (typo or pointing at another account's role); role trust policy does not include the ECS service principal; role was deleted/renamed after attach; cross-account role assumption without the trust relationship.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/db51f8c5be8b81f1. Report an issue: GitHub.