Error loading state: AccessDenied: Access Denied (AWS S3 backend)
Problem
Terraform Version [code block] Debug Output Crash Output [code block] Also tried with `profile`. Same thing. And when try this: [code block] Expected Behavior Actual Behavior Steps to Reproduce Additional Context User that is trying to access S3, have these policies set: [code block] I also tried adding AdministratorAccess, but it did not change anything. References https://github.com/hashicorp/terraform/issues/13589
Error Output
Error loading state: AccessDenied: Access Denied
Unverified for your environment
Select your OS to check compatibility.
1 Fix
Fix AWS S3 Access Denied Error in Terraform
The 'AccessDenied' error occurs when the AWS IAM user or role does not have sufficient permissions to access the specified S3 bucket or object. This can happen due to missing permissions in the IAM policy or incorrect bucket policies that restrict access.
Awaiting Verification
Be the first to verify this fix
- 1
Verify IAM User Permissions
Ensure that the IAM user or role has the necessary permissions to access the S3 bucket. The user should have at least 's3:GetObject', 's3:PutObject', and 's3:ListBucket' permissions for the bucket being accessed.
bashaws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess - 2
Check S3 Bucket Policy
Review the S3 bucket policy to ensure it allows access from the IAM user or role. If the bucket policy denies access, modify it to grant the necessary permissions.
json{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<account-id>:user/<username>" }, "Action": "s3:*", "Resource": [ "arn:aws:s3:::<bucket-name>", "arn:aws:s3:::<bucket-name>/*" ] } ] } - 3
Use Correct AWS Profile
If using multiple AWS profiles, ensure that the correct profile is set in your Terraform configuration. This can be done by setting the AWS_PROFILE environment variable or specifying the profile in the provider block.
bashexport AWS_PROFILE=<your-profile> provider "aws" { region = "us-west-2" profile = "<your-profile>" } - 4
Run Terraform Init
After making changes to IAM policies or S3 bucket policies, run 'terraform init' to reinitialize the backend and ensure that the changes are recognized.
bashterraform init
Validation
To confirm the fix worked, run 'terraform apply' and check for any errors. If the state loads successfully without 'AccessDenied' errors, the issue is resolved.
Sign in to verify this fix
Environment
Submitted by
Alex Chen
2450 rep