Terraform: Terraform init with s3 backend fails to check permissions

[rokka-n]

Terraform Configuration Files

terraform {
  backend "s3" {
    bucket = "vendor-terraform"
    key    = "terraform/us-west-2/terraform.tfstate"
    region = "us-west-2"
  }
}

Expected Behavior

Should error out if access to bucket not present, like this:

Error loading state: AccessDenied: Access Denied
    status code: 403, request id: xxx, host id: UuoNIqtPMPybqcLpSOxxxx=

Actual Behavior

No error

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform init

[elodani]

I encountered the same situation, but it does not cause a serious problem, terraform just notifies you of the error later than expected. If you call a terraform show or terraform plan after terraform init, it immediately tells you the expected error, and if you check the bucket in AWS, it is untouched. But I agree with you that the tool should tell that you lack credentials as early as possible and fail during init instead of silently continue like nothing happened.

[Vincenttoolate]

Hi rokka-n,

I had exactly the same issue. But once I gave the s3 bucket public access. Terraform no longer complains.

But I don't think give s3 public access is a permanently solution.

Waiting for some more valuable answers.

Cheers,
Vincent

[Mikulas]

This seems to be a duplicate of https://github.com/hashicorp/terraform/issues/5839

[tkjef]

check to make sure your environment is using the correct AWS account. You may have multiple accounts on your .aws/credentials

[dragonknight88]

@tkjef What happens if multiple profiles are specified in .aws/credentials. Which one does terraform picks for the init execution? And what could be done to specify the desired profile for init?

[mildwonkey]

@dragonknight88 - if nothing is set in terraform, the AWS SDK chooses which credentials to use. The aws provider authentication documentation is here.

[tkjef]

@dragonknight88 you can set the below:

AWS_PROFILE=aws_account_name
export AWS_PROFILE

in your ~/.bash_profile

[dragonknight88]

Thanks @tkjef My issue got resolved with setting AWS_PROFILE. The problem was with jenkins build system setup. It had configured AWS_ACCOUNT_KEY and SECREY_KEY env variable set up so regardless what I set in AWS_PROFILE tf was picking up ACCT and SECRET key config. I had to reset those on every stage in jenkins pipeline.

[deniojunior]

Are you sure your bucket is located in the same region you specified in your backend config? I had this issue once before and the error message is not clear enough.

[alfresanc]

The problem is that 'terraform init' is not following the same way to authenticate on AWS than the further steps (terraform plan, etc).

Also you could have added explicitly the AWS Auth data into Backend block:

terraform {
  backend "s3" {
    bucket        = "bucket-name"
    key              = "path/file.tfstate"
    region         = "us-east-1"
    encrypt       = true
    profile         = "profile_name"
    role_arn      = "arn:aws:iam::0000000000:role/if_needed"
  }
}