failed getting S3 bucket policy: couldn't find resource

[jorge-gonzalez-webbeds]

Description

I am trying to get the policy of a s3 bucket with this data:

resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

data "aws_s3_bucket_policy" "this" {
  bucket = aws_s3_bucket.this.id
}

To do this, I first import the bucket because that bucket already exists. The case may be that this bucket does not have any policy and when I try to get the policy I get the error that it could not get it. My idea was to take the policy with the resource of S3 and if it existed to make the data, but it jumps me that this attribute is deprecated. So I propose that in the case that the data of the policy of the s3 does not exist, it should return null and not to jump an error.

Error:
Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: failed getting S3 bucket policy (BUCKET_NAME): couldn't find resource
│
│ with module.source_bucket["BUCKET_NAME"].data.aws_s3_bucket_policy.this,
│ on modules/s3-bucket-configuration/aws_s3.tf line 65, in data "aws_s3_bucket_policy" "this":
│ 65: data "aws_s3_bucket_policy" "this" {

References

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket_policy
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#policy

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @jorge-gonzalez-webbeds 👋 Can you give me a better idea of your use case? I'm not sure that I follow what you're attempting to accomplish with your use case.

[jorge-gonzalez-webbeds]

Hii! @justinretzolk What I have done is to create a module to configure a bucket as I want, this configuration tries to apply a policy to be able to access to that bucker and enable the bucket. But the problem is that there are buckets that already exist and I should not change the policy that already exists. So in that module, I add a statement to that policy that already exists to not change the initial configuration. In the case that it does not have only, I add the new one.

[justinretzolk]

@jorge-gonzalez-webbeds Are you able to supply a sample Terraform configuration and steps to reproduce? I think that would help me to get a better idea of what you're attempting; unfortunately, I'm still not quite following, but would love to help.

[jorge-gonzalez-webbeds]

Hello @justinretzolk, the project it's so big. I give you a piece of the code.

resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

data "aws_s3_bucket_policy" "this" {
  count  = var.has_policy ? 1 : 0
  bucket = aws_s3_bucket.this.id
}

resource "aws_s3_bucket_policy" "this" {
  count = var.arn_iam_role_allow_access != "" ? 1 : 0

  bucket = aws_s3_bucket.this.id

  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : distinct(
      concat(
        can(data.aws_s3_bucket_policy.this[count.index].policy) ? jsondecode(
          data.aws_s3_bucket_policy.this[count.index].policy
        )["Statement"] : [],
        local.s3_bucket_policy["Statement"]
      )
    )
  })
}

Think about the case that you do not have the variable var.has_policy and you import an aws_s3_bucket with a policy. The data resource I run I get the error that it cannot find the resource. I didn't want to make use of the var.has_policy variable. So I suggested that this one, if not found, return null.

[el-chazmo]

This issue was meant to be resolved in v5.19 but I'm still facing this today.