Problem
You may encounter one of the following errors when Terraform attempts to read an S3 bucket policy that does not exist.
Validate Response s3/GetBucketPolicy failed, attempt 0/25, error NoSuchBucketPolicy: The bucket policy does not exist
Alternatively, you may see an HTTP 404 error in the response details.
Response s3/GetBucketPolicy Details: ---[ RESPONSE ]-------------------------------------- HTTP/1.1 404 Not Found Transfer-Encoding: chunked Content-Type: application/xml
Cause
This error typically occurs for one of the following reasons:
- An S3 bucket was created, but a bucket policy was never applied to it, so Terraform cannot find a policy to read or manage.
- An existing S3 bucket policy was modified or deleted outside of Terraform, causing a discrepancy between your Terraform state and the actual infrastructure.
- An attempt to apply an S3 policy failed during a previous run, possibly due to an issue with an older version of the AWS provider.
Solutions
Here are several approaches to resolve this issue.
Solution 1: Apply a Bucket Policy
If the S3 bucket is new or is not intended to have a policy, you can resolve the error by defining and applying a bucket policy using the aws_s3_bucket_policy resource in your Terraform configuration. This ensures that a policy exists for Terraform to manage.
Solution 2: Reconcile Policy Changes
If the bucket policy was changed or deleted manually in the AWS Console, your Terraform state is now out of sync. You can either re-apply your configuration to restore the policy as defined in your code or, if the manual change was intentional, update your Terraform configuration to match the new state.
Solution 3: Update the AWS Provider
Ensure you are using an up-to-date version of the HashiCorp AWS provider. Older versions may have bugs or limitations related to policy management that have since been resolved. Updating the provider may resolve unexpected failures when applying policies.
Additional Information
For more details on managing an S3 bucket policy with Terraform, refer to the AWS provider documentation for the aws_s3_bucket_policy resource.