awslabs / awslabs/aws-deployment-framework

[Bug]: Terraform pipeline unable to upload the tf statefile

Open
#745 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
699
Forks
235
Avg merge
20h 53m
Merged PRs (30d)
7

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Terraform pipeline returns permissions error when trying to upload the updated state file to the bucket S3 in the deployment account.

### Expected Behavior

Terraform pipeline should be able to upload the updated statefile to the target backend

### Current Behavior

Terraform pipeline returns the following error:

111 | Completed 2.9 KiB/2.9 KiB (17.5 KiB/s) with 1 file(s) remaining
112 | upload: ./kms-tf-xxx-20240709115249.log to s3://adf-global-base-deployment-pipelinebucket-10wtxr0gf8mah/kms-tf/tf-plan/2024-07-09/771873470680/kms-tf-xxxx-20240709115249.log
113 | Path to terraform plan s3://adf-global-base-deployment-pipelinebucket-10wtxr0gf8mah/kms-tf/tf-plan/2024-07-09/xxx/kms-tf-xxx-20240709115249.log
114 |  
115 | Error: Failed to save state
116 |  
117 | Error saving state: failed to upload state: AccessDenied: Access Denied
118 | status code: 403, request id: AZ4WMCYZK551JFSE, host id:
119 | zAKYWrBCz/XW6rNfO5mwHMoKMWOvJnBhNLKWOJ1YZzqx+cFqlIsAaQRuCfzhWBFOMEGj7+PCU+IjmyuL2qP84mVMon8zTm47
120 |  
121 | Error: Failed to persist state to backend
122 |  
123 | The error shown above has prevented Terraform from writing the updated state
124 | to the configured backend. To allow for recovery, the state has been written
125 | to the file "errored.tfstate" in the current working directory.
126 |  
127 | Running "terraform apply" again at this point will create a forked state,
128 | making it harder to recover.
129 |  
130 | To retry writing this state, use the following command:
131 | terraform state push errored.tfstate

### Steps To Reproduce

_No response_

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### ADF Version

4.0.0

### Contributing a fix?

- [ ] Yes, I am working on a fix to resolve this issue

Contributor guide

Open the contributing guide

Research direction

No file, test, or reproduction steps are named. Start by locating the Terraform pipeline and its S3 backend permissions, then reproduce the AccessDenied error; done means the pipeline can upload the updated state file to the target backend without a 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.