awslabs / awslabs/aws-deployment-framework
[Bug]: Terraform pipeline unable to upload the tf statefile
- Dominant language
- Python
- Stars
- 699
- Forks
- 235
- Avg merge
- 20h 53m
- Merged PRs (30d)
- 7
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
Terraform pipeline returns permissions error when trying to upload the updated state file to the bucket S3 in the deployment account.
### Expected Behavior
Terraform pipeline should be able to upload the updated statefile to the target backend
### Current Behavior
Terraform pipeline returns the following error:
111 | Completed 2.9 KiB/2.9 KiB (17.5 KiB/s) with 1 file(s) remaining
112 | upload: ./kms-tf-xxx-20240709115249.log to s3://adf-global-base-deployment-pipelinebucket-10wtxr0gf8mah/kms-tf/tf-plan/2024-07-09/771873470680/kms-tf-xxxx-20240709115249.log
113 | Path to terraform plan s3://adf-global-base-deployment-pipelinebucket-10wtxr0gf8mah/kms-tf/tf-plan/2024-07-09/xxx/kms-tf-xxx-20240709115249.log
114 |
115 | Error: Failed to save state
116 |
117 | Error saving state: failed to upload state: AccessDenied: Access Denied
118 | status code: 403, request id: AZ4WMCYZK551JFSE, host id:
119 | zAKYWrBCz/XW6rNfO5mwHMoKMWOvJnBhNLKWOJ1YZzqx+cFqlIsAaQRuCfzhWBFOMEGj7+PCU+IjmyuL2qP84mVMon8zTm47
120 |
121 | Error: Failed to persist state to backend
122 |
123 | The error shown above has prevented Terraform from writing the updated state
124 | to the configured backend. To allow for recovery, the state has been written
125 | to the file "errored.tfstate" in the current working directory.
126 |
127 | Running "terraform apply" again at this point will create a forked state,
128 | making it harder to recover.
129 |
130 | To retry writing this state, use the following command:
131 | terraform state push errored.tfstate
### Steps To Reproduce
_No response_
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### ADF Version
4.0.0
### Contributing a fix?
- [ ] Yes, I am working on a fix to resolve this issue
Contributor guide
Research direction
No file, test, or reproduction steps are named. Start by locating the Terraform pipeline and its S3 backend permissions, then reproduce the AccessDenied error; done means the pipeline can upload the updated state file to the target backend without a 403.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100