执行terraform apply时忽略已导入S3桶，触发BucketAlreadyOwnedByYou错误？

问题 #

我有一个已存在的S3桶prod-media-8675309，该桶同时用作Terraform的后端状态存储桶。执行terraform import命令导入该桶后显示成功，但运行terraform plan和terraform apply时，始终触发BucketAlreadyOwnedByYou错误。

相关配置代码 #

s3.tf

resource "aws_s3_bucket" "prod_media" {
  bucket = var.prod_media_bucket
  force_destroy = true
}

resource "aws_s3_bucket_cors_configuration" "prod_media" {
  bucket = aws_s3_bucket.prod_media.id  

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = ["*"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }  
}

resource "aws_s3_bucket_acl" "prod_media" {
    bucket = aws_s3_bucket.prod_media.id
    acl    = "public-read"
    depends_on = [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership]
}

resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
  bucket = aws_s3_bucket.prod_media.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
  depends_on = [aws_s3_bucket_public_access_block.example]
}

resource "aws_iam_user" "prod_media_bucket" {
  name = "prod-media-bucket"
}

resource "aws_s3_bucket_public_access_block" "example" {
  bucket = aws_s3_bucket.prod_media.id

  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

resource "aws_s3_bucket_policy" "prod_media_bucket" {
    bucket = aws_s3_bucket.prod_media.id
    policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Principal = "*"
        Action = [
          "s3:*",
        ]
        Effect = "Allow"
        Resource = [
          "arn:aws:s3:::${var.prod_media_bucket}",
          "arn:aws:s3:::${var.prod_media_bucket}/*"
        ]
      },
      {
        Sid = "PublicReadGetObject"
        Principal = "*"
        Action = [
          "s3:GetObject",
        ]
        Effect   = "Allow"
        Resource = [
          "arn:aws:s3:::${var.prod_media_bucket}",
          "arn:aws:s3:::${var.prod_media_bucket}/*"
        ]
      },
    ]
  })
  
  depends_on = [aws_s3_bucket_public_access_block.example]
}

resource "aws_iam_access_key" "prod_media_bucket" {
  user = aws_iam_user.prod_media_bucket.name
}

variables.tf（部分内容）

variable "prod_media_bucket" {
  description = "S3 Bucket for production media files"
  default = "prod-media-8675309"
}

provider.tf（部分内容）

terraform {
  backend "s3" {
    bucket = "prod-media-8675309"
    key    = "terraform"
    region = "us-east-2"
  }
}

执行的命令 #

terraform import aws_s3_bucket.prod_media prod-media-8675309
terraform plan
terraform apply

解决建议 #

• 检查状态与配置的一致性：执行terraform state show aws_s3_bucket.prod_media，确认桶的bucket名称、region等属性和本地配置完全匹配。如果后端存储桶的region和Provider默认region不一致，会触发Terraform尝试重新创建桶。
• 规避后端桶的循环冲突：由于该桶同时作为Terraform后端存储，apply时会出现"读取状态→修改桶配置"的循环冲突。可以临时切换到本地后端完成配置同步：
  1. 创建临时后端配置文件backend-local.tf：

     terraform {
       backend "local" {
         path = "terraform.tfstate"
       }
     }
     

  2. 执行terraform init -reconfigure切换到本地后端
  3. 运行terraform plan和terraform apply完成配置同步
  4. 确认无误后删除临时文件，再执行terraform init -reconfigure切回S3后端
• 明确指定桶的region属性：在aws_s3_bucket.prod_media资源中添加与后端桶一致的region配置，避免Terraform因region歧义尝试创建新桶：

  resource "aws_s3_bucket" "prod_media" {
    bucket = var.prod_media_bucket
    force_destroy = true
    region = "us-east-2" # 和后端桶的region保持一致
  }
  

• 导入关联资源的现有状态：除了桶本身，导入已存在的关联资源（如ACL、CORS配置），避免Terraform尝试重新创建这些资源：

  terraform import aws_s3_bucket_acl.prod_media prod-media-8675309
  terraform import aws_s3_bucket_cors_configuration.prod_media prod-media-8675309
  

内容的提问来源于stack exchange，提问作者Mark