无法对齐导入的 S3 存储桶地形配置

Question

I have imported an existing S3 bucket to my terraform state.

I am now trying to reverse engineer its configuration and pass it to the .tf file.

Here is my file

resource "aws_s3_bucket" "my-bucket" {
  provider = "aws.eu_west_1"
  bucket   = "my-bucket"

  grant {
      type        = "Group"
      permissions = ["READ_ACP", "WRITE"]
      uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
    }

  grant {
      id          = "my-account-id"
      type        = "CanonicalUser"
      permissions = ["FULL_CONTROL"]
  }

Here is my terraform plan output

  ~ aws_s3_bucket.my-bucket
      acl:                                                     "" => "private"

No matter what value I use for the acl I always fail to align my tf with the existing acl configuration on the S3 bucket, eg

resource "aws_s3_bucket" "my-bucket" {
  provider = "aws.eu_west_1"
  bucket   = "my-bucket"
  acl.     = "private"

corresponding plan output:

Error: aws_s3_bucket.my-bucket: "acl": conflicts with grant
Error: aws_s3_bucket.my-bucket: "grant": conflicts with acl

and another:

resource "aws_s3_bucket" "my-bucket" {
  provider = "aws.eu_west_1"
  bucket   = "my-bucket"
  acl.     = ""

resource "aws_s3_bucket" "my-bucket" {
  provider = "aws.eu_west_1"
  bucket   = "my-bucket"
  acl.     = ""

so if I use no value for acl, terraform shows the acl will change from non-set to private

If I use any value whatsoever, I get an error.

Why is that?

Answer 1

This is an observation on 0.13 but still might help:

If I create a bucket using your original code (ie with no acl line), the resulting TF state file still includes a "acl": "private", attribute for the bucket. If I then add an acl="private" definition in the TF code, I also get "acl": conflicts with grant when trying to apply.

But what's really odd is that if I delete the acl="private" definition (ie revert to your original code), and also delete the "acl": "private", attribute line from the state file, then the plan (including a refresh) shows that the bucket will be updated in place with this: + acl = "private" . Applying this seems to work fine, but then a second apply shows that the grants have been lost and need to be reapplied.

So it seems to me that there's a bug in the S3 state refresh that might also affect the import, and in addition clearly removing the acl attribute from state makes it then incorrectly apply as a default overriding any grants. I think it might be worth using your code to create a new bucket, and then compare the state definitions to bring over any bits the original import missed.