What causes "unable to initialize the location client: %#v" in hashicorp/terraform?

Provide valid access_key/secret_key (and security_token if using STS) in the backend block or via ALICLOUD_* env vars.

unable to initialize the location client: %#v

Error message

unable to initialize the location client: %#v

What it means

Returned by getOSSEndpointByRegion when location.NewClientWithOptions fails while constructing the Alibaba Cloud Location SDK client used to discover the OSS endpoint for a region. The %#v renders the SDK error struct (usually a credential or config error).

Source

Thrown at internal/backend/remote-state/oss/backend.go:452

		if otsInstanceName == "" {
			otsInstanceName = strings.Split(strings.TrimPrefix(strings.TrimPrefix(otsEndpoint, "https://"), "http://"), ".")[0]
		}
		b.otsClient = tablestore.NewClientWithConfig(otsEndpoint, otsInstanceName, accessKey, secretKey, securityToken, tablestore.NewDefaultTableStoreConfig())
	}
	b.otsTable = d.Get("tablestore_table").(string)

	return err
}

func (b *Backend) getOSSEndpointByRegion(access_key, secret_key, security_token, region string) (*location.DescribeEndpointsResponse, error) {
	args := location.CreateDescribeEndpointsRequest()
	args.ServiceCode = "oss"
	args.Id = region
	args.Domain = "location-readonly.aliyuncs.com"

	locationClient, err := location.NewClientWithOptions(region, getSdkConfig(), credentials.NewStsTokenCredential(access_key, secret_key, security_token))
	if err != nil {
		return nil, fmt.Errorf("unable to initialize the location client: %#v", err)

	}
	locationClient.AppendUserAgent(TerraformUA, TerraformVersion)
	endpointsResponse, err := locationClient.DescribeEndpoints(args)
	if err != nil {
		return nil, fmt.Errorf("describe oss endpoint using region: %#v got an error: %#v", region, err)
	}
	return endpointsResponse, nil
}

func getAssumeRoleAK(accessKey, secretKey, stsToken, region, roleArn, sessionName, policy, stsEndpoint string, sessionExpiration int) (string, string, string, error) {
	request := sts.CreateAssumeRoleRequest()
	request.RoleArn = roleArn
	request.RoleSessionName = sessionName
	request.DurationSeconds = requests.NewInteger(sessionExpiration)
	request.Policy = policy
	request.Scheme = "https"

View on GitHub (pinned to c9def3e214)

Solutions

Provide valid access_key/secret_key (and security_token if using STS) in the backend block or via ALICLOUD_* env vars.
Set a valid region (e.g. cn-hangzhou, us-west-1) via region attr or ALICLOUD_REGION.
If on an ECS instance, set ecs_role_name so creds are fetched from the metadata service instead.
Avoid passing an empty string for any of access_key/secret_key/security_token.

Example fix

# before
region  = ""
# creds missing -> location client init fails

# after
region     = "cn-hangzhou"
access_key = "LTAI..."
secret_key = "abc..."

Defensive patterns

Strategy: validation

Validate before calling

func validateCreds(ak, sk, token, region string) error {
    if ak == "" || sk == "" || region == "" {
        return fmt.Errorf("access_key, secret_key and region are required when endpoint is unset")
    }
    return nil
}

Try / catch

if _, err := b.getOSSEndpointByRegion(ak, sk, tok, region); err != nil {
    log.Printf("[WARN] location discovery failed: %v", err)
    endpoint = fmt.Sprintf("oss-%s.aliyuncs.com", region)
}

Prevention

Always set region.
Provide complete credential triples (ak, sk, optional token).
On ECS, use ecs_role_name instead of partial static creds.

When it happens

Trigger: The backend is configured without an explicit endpoint, so configure() calls getOSSEndpointByRegion. location.NewClientWithOptions fails because the STS token credential (access_key/secret_key/security_token) is malformed or nil, or the region string is empty/invalid.

Common situations: Missing or blank ALICLOUD_ACCESS_KEY/SECRET_KEY env vars; empty region; running on ECS without ecs_role_name and without static creds; security_token expired; region set to an unsupported value.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/b6a845b696c3689a. Report an issue: GitHub.