hashicorp/terraform · error

unmarshal Ecs sts token response err : %s

Error message

unmarshal Ecs sts token response err : %s

What it means

Returned by getAuthCredentialByEcsRoleName when responses.Unmarshal fails to parse the HTTP response from the ECS metadata service into a CommonResponse. This is a low-level unmarshal failure, typically an encoding/content-type problem rather than a logical one.

Source

Thrown at internal/backend/remote-state/oss/backend.go:665

		return
	}
	requestUrl := securityCredURL + ecsRoleName
	httpRequest, err := http.NewRequest(requests.GET, requestUrl, strings.NewReader(""))
	if err != nil {
		err = fmt.Errorf("build sts requests err: %s", err.Error())
		return
	}
	httpClient := &http.Client{}
	httpResponse, err := httpClient.Do(httpRequest)
	if err != nil {
		err = fmt.Errorf("get Ecs sts token err : %s", err.Error())
		return
	}

	response := responses.NewCommonResponse()
	err = responses.Unmarshal(response, httpResponse, "")
	if err != nil {
		err = fmt.Errorf("unmarshal Ecs sts token response err : %s", err.Error())
		return
	}

	if response.GetHttpStatus() != http.StatusOK {
		err = fmt.Errorf("get Ecs sts token err, httpStatus: %d, message = %s", response.GetHttpStatus(), response.GetHttpContentString())
		return
	}
	var data interface{}
	err = json.Unmarshal(response.GetHttpContentBytes(), &data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, json.Unmarshal fail: %s", err.Error())
		return
	}
	code, err := jmespath.Search("Code", data)
	if err != nil {
		err = fmt.Errorf("refresh Ecs sts token err, fail to get Code: %s", err.Error())
		return
	}

View on GitHub (pinned to c9def3e214)

Solutions

  1. Retry the operation — transient transport corruption is the most common cause.
  2. Check for any HTTP proxy intercepting 100.100.100.200 traffic and disable it for link-local.
  3. Verify the alibaba-cloud-sdk-go dependency version is current; older versions had unmarshal edge cases.
  4. curl the metadata URL directly to inspect the raw response framing.

Example fix

# before: egress proxy rewriting metadata responses
HTTP_PROXY=http://corp-proxy:8080

# after: exclude the metadata host
NO_PROXY=100.100.100.200,169.254.169.254
HTTP_PROXY=http://corp-proxy:8080
Defensive patterns

Strategy: retry

Try / catch

if _, err := getAuthCredentialByEcsRoleName(role); err != nil {
    if strings.Contains(err.Error(), "unmarshal Ecs sts token response") {
        time.Sleep(2 * time.Second)
        return getAuthCredentialByEcsRoleName(role) // one bounded retry
    }
    return err
}

Prevention

When it happens

Trigger: The metadata service returns a body that the alibaba-cloud-sdk-go responses.Unmarshal cannot decode (unexpected Content-Encoding, truncated chunked response, gzip when none expected). Distinct from a non-200 status (error 335) or JSON parse failure (error 336).

Common situations: A transparent proxy mangling/compressing metadata responses; SDK version skew where the transport encoding changed; rare metadata service hiccup returning a malformed frame.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a9314101b1269f39. Report an issue: GitHub.