aws_s3_bucket: During terraform import - ACL is populated with "null" in tfstate, and terraform apply defaults to acl=private

[itsjwala]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.14.6
+ provider registry.terraform.io/hashicorp/aws v3.27.0

Your version of Terraform is out of date! The latest version
is 0.14.7. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• aws_s3_bucket

Terraform Configuration Files

Note - This only occurs while importing S3 bucket

  acl           = null
  grant {
    permissions = ["READ_ACP", "WRITE"]
    type        = "Group"
    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
  }
  grant {
    permissions = ["READ_ACP"]
    type        = "Group"
    uri         = "http://acs.amazonaws.com/groups/global/AllUsers"
  }
  grant {
    id          = "someid"
    permissions = ["FULL_CONTROL"]
    type        = "CanonicalUser"
  }

Debug Output

Panic Output

Expected Behavior

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.

Actual Behavior

      + acl                         = "private"

Steps to Reproduce

1. import existing s3 bucket which has public access (so as to fill the grant block)

 terraform import aws_s3_bucket.bucket_name bucket_name

2. Fill up the terraform file

bucket.tf

  acl           = null
  grant {
    permissions = ["READ_ACP", "WRITE"]
    type        = "Group"
    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
  }
  grant {
    permissions = ["READ_ACP"]
    type        = "Group"
    uri         = "http://acs.amazonaws.com/groups/global/AllUsers"
  }
  grant {
    id          = "someid"
    permissions = ["FULL_CONTROL"]
    type        = "CanonicalUser"
  }

# other details skipped for brevity

3. terraform apply

      + acl                         = "private"

[itsjwala]

irrespective of grant block present or not, terraform import doesn't populate acl argument
I had to manually update acl to private in terraform.tfstate to make sure there is no diff

bucket.tf

  # skipped .. 
  grant {
    permissions = ["READ_ACP", "WRITE"]
    type        = "Group"
    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
  }
  grant {
    permissions = ["READ_ACP"]
    type        = "Group"
    uri         = "http://acs.amazonaws.com/groups/global/AllUsers"
  }
  grant {
    id          = "someid"
    permissions = ["FULL_CONTROL"]
    type        = "CanonicalUser"
  }

# other details skipped for brevity

terraform.tfstate

// skipped..
        {
          "schema_version": 0,
          "attributes": {
            "acceleration_status": "",
            "acl": "private",

output

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.

[natalysheinin]

I ran into this bug as well and had to manually edit the state file. This should definitely be addressed.

[pdecat]

This looks like a duplicate of #6193

[m1mohamad]

I have similar issue but always populated with

• acl = "private"
• force_destroy = false

When importing the bucket , doing -target plan
terraform version 1.0.7

[SimonEdwardsMQA]

To get around this, I've added the below so that Terraform ignores the missing acl & force_destory, this saves having to mess around with the state file.

lifecycle {
    ignore_changes = [
      acl,
      force_destroy,
    ]
  }

Interestingly a terraform state show doesn't list either of these.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!