{"record":{"id":"0c7f841682ec2f66","repo":"hashicorp/terraform","slug":"s3-bucket-q-does-not-exist-the-referenced-s3-bu-0c7f84","errorCode":null,"errorMessage":"S3 bucket %q does not exist.\n\nThe referenced S3 bucket must have been previously created. If the S3 bucket\nwas created within the last minute, please wait for a minute or two and try\nagain.\n\nError: %s","messagePattern":"S3 bucket %q does not exist\\.\n\nThe referenced S3 bucket must have been previously created\\. If the S3 bucket\nwas created within the last minute, please wait for a minute or two and try\nagain\\.\n\nError: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/s3/client.go","lineNumber":142,"sourceCode":"\treturn payload, diags.Append(err)\n}\n\nfunc (c *RemoteClient) get(ctx context.Context) (*remote.Payload, error) {\n\theadInput := &s3.HeadObjectInput{\n\t\tBucket: aws.String(c.bucketName),\n\t\tKey:    aws.String(c.path),\n\t}\n\tif c.serverSideEncryption && c.customerEncryptionKey != nil {\n\t\theadInput.SSECustomerKey = aws.String(base64.StdEncoding.EncodeToString(c.customerEncryptionKey))\n\t\theadInput.SSECustomerAlgorithm = aws.String(s3EncryptionAlgorithm)\n\t\theadInput.SSECustomerKeyMD5 = aws.String(c.getSSECustomerKeyMD5())\n\t}\n\n\theadOut, err := c.s3Client.HeadObject(ctx, headInput)\n\tif err != nil {\n\t\tswitch {\n\t\tcase IsA[*s3types.NoSuchBucket](err):\n\t\t\treturn nil, fmt.Errorf(errS3NoSuchBucket, c.bucketName, err)\n\t\tcase IsA[*s3types.NotFound](err):\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"Unable to access object %q in S3 bucket %q: %w\", c.path, c.bucketName, err)\n\t}\n\n\t// Pre-allocate the full buffer to avoid re-allocations and GC\n\tbuf := make([]byte, int(aws.ToInt64(headOut.ContentLength)))\n\tw := manager.NewWriteAtBuffer(buf)\n\n\tdownloadInput := &s3.GetObjectInput{\n\t\tBucket: aws.String(c.bucketName),\n\t\tKey:    aws.String(c.path),\n\t}\n\tif c.serverSideEncryption && c.customerEncryptionKey != nil {\n\t\tdownloadInput.SSECustomerKey = aws.String(base64.StdEncoding.EncodeToString(c.customerEncryptionKey))\n\t\tdownloadInput.SSECustomerAlgorithm = aws.String(s3EncryptionAlgorithm)\n\t\tdownloadInput.SSECustomerKeyMD5 = aws.String(c.getSSECustomerKeyMD5())","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/s3/client.go#L124-L160","documentation":"Thrown in RemoteClient.get() (s3/client.go:142) when the HeadObject call returns *s3types.NoSuchBucket. The configured bucket does not exist (or is invisible to the caller's credentials in the resolved region) at state-read time. Same multi-line errS3NoSuchBucket message used elsewhere in the S3 backend.","triggerScenarios":"Bucket deleted between init and a later read; wrong bucket name/region in config; AssumeRole to the wrong account; bucket created <1 min ago and not yet consistent.","commonSituations":"Bucket recreated/renamed without updating the backend config; region mismatch; cross-account access misconfigured; credentials silently switched accounts.","solutions":["Verify the bucket exists and is in the configured region (`aws s3api head-bucket --bucket <name>`).","Confirm caller identity matches the owning account (`aws sts get-caller-identity`).","Correct the bucket/region in the backend config or recreate the bucket.","Wait one to two minutes if it was just created, then retry."],"exampleFix":"// verify before reading state\n// aws s3api head-bucket --bucket mycorp-tfstate --region us-west-2","handlingStrategy":"validation","validationCode":"// Confirm bucket existence + region before reading state\n// out, err := s3Client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)})\n// if err != nil { return fmt.Errorf(\"bucket missing: %w\", err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Gate init on a `aws s3api head-bucket` check.","Lock the backend config so the bucket/region cannot drift.","Confirm the assumed role lands in the owning account."],"tags":["s3","aws","bucket","config","remote-state"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}