使用Terraform配置S3 Bucket Policy遇AccessDenied但AWS GUI可成功应用

使用Terraform v1.6.6创建S3存储桶并配置Bucket Policy时，出现AccessDenied错误，但通过AWS图形界面（GUI）手动应用相同策略却能成功。

Terraform配置 #

provider "aws" {
  alias = "main"
  region = var.region
}


# Create the S3 bucket
resource "aws_s3_bucket" "ctcuserkycdoc" {
  bucket = "ctcuserkycdoc"
}


resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.ctcuserkycdoc.id  
  policy = <<EOF
{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowPublicRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:ListBucket",
        "s3:DeleteObject",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::ctcuserkycdoc",
        "arn:aws:s3:::ctcuserkycdoc/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "13.176.4.126"
          ]
        }
      }
    }
  ]
}
EOF
}

# Output the S3 bucket ARN
output "s3_bucket_arn" {
  value = aws_s3_bucket.ctcuserkycdoc.arn
}

报错信息 #

aws_s3_bucket.ctcuserkycdoc: Creating...
aws_s3_bucket.ctcuserkycdoc: Creation complete after 8s [id=ctcuserkycdoc]
aws_s3_bucket_policy.bucket_policy: Creating...
╷
│ Error: putting S3 Bucket (ctcuserkycdoc) Policy: operation error S3: PutBucketPolicy, https response error StatusCode: 403, RequestID: TK7FT2H1R49T3N1V, HostID: tZa9+/mHxsyjuEQ+Kai+saE5/eKZrW57CY+AJ11IVsBZu2YWY4TCxxMl2UAgUsdasWMA6UDn9NhcGCo=, api error AccessDenied: Access Denied
│
│   with aws_s3_bucket_policy.bucket_policy,
│   on main.tf line 14, in resource "aws_s3_bucket_policy" "bucket_policy":
│   14: resource "aws_s3_bucket_policy" "bucket_policy" {

已执行的排查步骤 #

• IAM权限：确认执行Terraform的IAM用户/角色拥有必要权限，包括s3:PutBucketPolicy；
• 策略文档：验证策略文档的语法和一致性；
• 提供商配置：确认Terraform中的AWS提供商配置正确；
• Terraform状态：检查Terraform状态中是否存在现有策略冲突。

可能的解决办法 #

1. 指定AWS提供商别名
   你配置了带alias = "main"的AWS提供商，但S3资源未关联该提供商，导致Terraform使用默认提供商（可能不是预期的账号/角色）。修改资源，添加provider = aws.main引用：

   resource "aws_s3_bucket" "ctcuserkycdoc" {
     provider = aws.main
     bucket = "ctcuserkycdoc"
   }
   
   resource "aws_s3_bucket_policy" "bucket_policy" {
     provider = aws.main
     bucket = aws_s3_bucket.ctcuserkycdoc.id  
     policy = <<EOF
     # 原策略内容
     EOF
   }
   

2. 检查IAM权限的深层限制
   即使IAM用户有s3:PutBucketPolicy权限，还需排查：

   • 该用户是否有**权限边界（Permission Boundary）**限制了操作；
   • 账号的**服务控制策略（SCP）**是否禁止了s3:PutBucketPolicy；
   • 确认IAM策略的资源范围包含目标桶ARN，比如：

     {
       "Effect": "Allow",
       "Action": "s3:PutBucketPolicy",
       "Resource": "arn:aws:s3:::ctcuserkycdoc"
     }
     

3. 配置桶所有权控制
   如果存储桶启用了所有权控制，需先配置正确的规则，避免权限冲突：

   resource "aws_s3_bucket_ownership_controls" "ctcuserkycdoc" {
     provider = aws.main
     bucket = aws_s3_bucket.ctcuserkycdoc.id
     rule {
       object_ownership = "BucketOwnerPreferred"
     }
   }
   
   resource "aws_s3_bucket_policy" "bucket_policy" {
     provider = aws.main
     bucket = aws_s3_bucket.ctcuserkycdoc.id  
     policy = <<EOF
     # 原策略内容
     EOF
     depends_on = [aws_s3_bucket_ownership_controls.ctcuserkycdoc]
   }
   

4. 调整公共访问阻止设置
   由于策略包含Principal: "*"，需确保桶的公共访问阻止未禁止公共策略：

   resource "aws_s3_bucket_public_access_block" "ctcuserkycdoc" {
     provider = aws.main
     bucket = aws_s3_bucket.ctcuserkycdoc.id
     block_public_acls       = false
     block_public_policy     = false
     ignore_public_acls      = false
     restrict_public_buckets = false
   }
   
   resource "aws_s3_bucket_policy" "bucket_policy" {
     provider = aws.main
     bucket = aws_s3_bucket.ctcuserkycdoc.id  
     policy = <<EOF
     # 原策略内容
     EOF
     depends_on = [aws_s3_bucket_public_access_block.ctcuserkycdoc]
   }
   

内容的提问来源于stack exchange，提问作者Krishnendu