terragrunt plan: NoSuchBucketPolicy: The bucket policy does not exist

[sowinski]

Hi,

I created a S3 bucket and dynamotable for my backend.

terraform {
  required_version = ">= 1.0.0, < 2.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }

    random = {
      source = "hashicorp/random"
    }
  }
}

resource "random_string" "name_suffix" {
  length        = 8
  special       = false
  upper         = false
  lower         = true
  numeric       = true
  min_numeric   = 4
  min_lower     = 4
}

provider "aws" {
  region = "eu-central-1"
}

resource "aws_s3_bucket" "terraform_state" {
  bucket = "terraform-state-${random_string.name_suffix.result}"
}

# Enable versioning so you can see the full revision history of your
# state files
resource "aws_s3_bucket_versioning" "enabled" {
  bucket = aws_s3_bucket.terraform_state.id
  versioning_configuration {
    status = "Enabled"
  }
}

# Enable server-side encryption by default
resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Explicitly block all public access to the S3 bucket
resource "aws_s3_bucket_public_access_block" "public_access" {
  bucket                  = aws_s3_bucket.terraform_state.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_dynamodb_table" "terraform_locks" {
  name         = "terraform-locks-${random_string.name_suffix.result}"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }
}

I setuped the backend in terragrunt and it generated a correct backend.tf which I also can use to create a s3 bucket.

=>
_If I use terraform without terragrunt and add a S3 bucket for example in a main.tf it is working.
After running terraform apply => I can see the bucket in AWS and the state is updated in the S3 bucket which stores the state.

Same thing while using terragrunt apply._

If I remove my .tf files and start using modules in .hcl directly I get this error after running terraform plan:

terragrunt plan
ERRO[0000] NoSuchBucketPolicy: The bucket policy does not exist
	status code: 404, request id: DRS6WX9KYNCS83BC, host id: 4ySkx4FMPb+J8B99WRqwk580UyrXylLPrPHD1lgvSuLkrJj1TRx39Yyy8mzsIFBugI9IzuSDVfI= 
ERRO[0000] Unable to determine underlying exit code, so Terragrunt will exit with error code 1 

Any idea what is wrong?

My terragrunt.hcl file looks like that:

remote_state {
  backend = "s3"

  generate = {
    path      = "backend.tf"
    if_exists = "overwrite"
  }

  config = {
    bucket         = "terraform-state-123123"
    key            = "${path_relative_to_include()}/terraform.tfstate"
    region         = "eu-central-1"
    encrypt        = true
    dynamodb_table = "terraform-locks-123123"

  }
}

terraform {
  source = "git::ssh://[email protected]/xxx/terraform-modules.git//modules/data-stores/s3/django-media-static?ref=v0.0.2"
}

---

Tracked in ticket #110557

[denis256]

Hello,
which version of Terragrunt and Terraform are used?

[jofan]

I get the same error and I have following versions:

Terragrunt: v0.53.6
Terraform: v1.6.4-dev

[joembarron]

@denis256 I'm also encountering this same problem. Ran into it while going through the Terraform Up and Running book.

[jwbrown77]

Also hitting this. macOS 14.1.2 on M1.

terragrunt --version
terragrunt version 0.54.3

terraform version
Terraform v1.6.6
on darwin_arm64

[denis256]

Hi,
I suspect it may be fixed in v0.54.4, please upgrade and check

[romga]

i have added to the conifg disable_bucket_update = true and it solved the issue

[denis256]

Hi,
I think it was fixed in v0.54.14, it is not happening when I do the same steps as described

[pnedkov]

FYI, I had the same issue with Terragrunt 0.54.8 which is the last version in Arch Linux at the moment. After manually switching to 0.54.20 the problem is gone.

Funny enough installing terragrunt with pacman and checking the version gives you this:

$ terragrunt --version
terragrunt version latest
$

[denis256]

Hi, good to know
pacman version issue seems to be related to how Terragrunt is built, I use tgenv scripts to install the release directly from the Github release page.