使用Terraform创建aws_s3_bucket_acl时遇AccessControlListNotSupported错误

错误信息 #

Error: error creating S3 bucket ACL for bucket-name: AccessControlListNotSupported: The bucket does not allow ACLs │ status code: 400

问题原因 #

自2023年4月起，AWS完成了S3服务的默认配置更新，新创建的存储桶默认禁用了ACL功能，因此直接创建aws_s3_bucket_acl资源会触发上述错误。

解决方案 #

方案1：开启存储桶的ACL支持 #

在定义aws_s3_bucket资源时，通过object_ownership参数指定支持ACL的模式，可选值为ObjectWriter或BucketOwnerPreferred。示例代码：

resource "aws_s3_bucket" "target_bucket" {
  bucket = "bucket-name"

  # 开启ACL支持
  object_ownership = "BucketOwnerPreferred"
}

resource "aws_s3_bucket_acl" "bucket_acl" {
  bucket = aws_s3_bucket.target_bucket.id
  acl    = "private"
}

方案2：使用Bucket Policy替代ACL #

AWS推荐使用Bucket Policy进行存储桶权限管理，替代传统的ACL。示例代码：

resource "aws_s3_bucket" "target_bucket" {
  bucket = "bucket-name"
}

resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.target_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::123456789012:user/your-iam-user" }
        Action    = ["s3:GetObject", "s3:PutObject"]
        Resource  = [
          "${aws_s3_bucket.target_bucket.arn}",
          "${aws_s3_bucket.target_bucket.arn}/*"
        ]
      }
    ]
  })
}

内容的提问来源于stack exchange，提问作者mameurer