Terraform-provider-aws: import aws_s3_bucket does not store important attributes like acl

[7rack]

i am trying to import exist s3 resource. generating hcl with terraforming, and importing statefile with terraform.
after import , while run terraform plan cannot get zero changes.
Terraform verion

Terraform v0.11.8
+ provider.aws v1.38.0

Terraform Configuration Files

_main.tf_

terraform {
  backend "s3" {
    bucket         = "terraform-state-foodev-global"
    dynamodb_table = "terraform-lock-foodev-global"
    key            = "s3/terraform.tfstate"
    region         = "ap-southeast-1"
  }
}

provider "aws" {
  region = "ap-southeast-1"
}

_resource.tf_ -- generated by terraforming

resource "aws_s3_bucket" "freeman-test2" {
  bucket        = "freeman-test2"
  acl           = "private"
}

Output

$ terraform import aws_s3_bucket.freeman-test2 freeman-test2

Acquiring state lock. This may take a few moments...
aws_s3_bucket.freeman-test2: Importing from ID "freeman-test2"...
aws_s3_bucket.freeman-test2: Import complete!
  Imported aws_s3_bucket (ID: freeman-test2)
aws_s3_bucket.freeman-test2: Refreshing state... (ID: freeman-test2)

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

Releasing state lock. This may take a few moments...

$ terraform plan
aws_s3_bucket.freeman-test2: Refreshing state... (ID: freeman-test2)
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place
Terraform will perform the following actions:

  ~ aws_s3_bucket.freeman-test2
      acl:           "" => "private"
      force_destroy: "" => "false"

Plan: 0 to add, 1 to change, 0 to destroy.

and check s3/terraform.tfstate file, without acl attribute

Expected Behavior
run terraform plan get zero changes.

[Willis0826]

The issue is persist in Terraform v0.12.18. The acl and force_destroy of S3 is still missing after imported.

[jerryhebert]

I'm seeing this with Terraform 0.12.26 and version 2.69.0 of the aws provider. It's concerning when there are grants involved since trying to apply past this actually removed the grant. Here are the steps I observed:

1. Defined my aws_s3_bucket resource which included no specification of the acl property but did have one grant block.
2. Imported the bucket
3. Ran a plan, acl and force_destroy showed as dirty.
4. Attempted to set acl even though it's conflicting but this was disallowed. Setting force_destroy to false as the plan showed also did not seem to take any effect.
5. I decided to try to apply anyway, as this was a low risk bucket. Applying the phantom acl = "private" change actually removed my grant!
6. I ran another plan with the same source code which showed the grant as a new addition, since it had been removed.
7. I applied this and now the plan is finally clean.

I am not sure how to account for this without hacking the state file to add the acl (and maybe force_destroy) attributes directly but I have not been able to get an empty plan in this case and applying it is dangerous on high risk buckets since this would temporarily remove the policy as specified in code.

[benyitzhaki]

we are experiencing the same issue. terraform v0.12.28, aws provider 2.58.0

[arjunrv88]

This is issue is still being seen with Terraform v0.12.24, aws-provider 3.3.0

[mattmelgard]

Would be great to get some kind of update on this if possible. This still seems to be a problem and the issue has been around for about 2 years now.