{"record":{"id":"c75f727b51a26325","repo":"hashicorp/terraform","slug":"unable-to-access-object-q-in-s3-bucket-q-w","errorCode":null,"errorMessage":"Unable to access object %q in S3 bucket %q: %w","messagePattern":"Unable to access object %q in S3 bucket %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/s3/client.go","lineNumber":146,"sourceCode":"\theadInput := &s3.HeadObjectInput{\n\t\tBucket: aws.String(c.bucketName),\n\t\tKey:    aws.String(c.path),\n\t}\n\tif c.serverSideEncryption && c.customerEncryptionKey != nil {\n\t\theadInput.SSECustomerKey = aws.String(base64.StdEncoding.EncodeToString(c.customerEncryptionKey))\n\t\theadInput.SSECustomerAlgorithm = aws.String(s3EncryptionAlgorithm)\n\t\theadInput.SSECustomerKeyMD5 = aws.String(c.getSSECustomerKeyMD5())\n\t}\n\n\theadOut, err := c.s3Client.HeadObject(ctx, headInput)\n\tif err != nil {\n\t\tswitch {\n\t\tcase IsA[*s3types.NoSuchBucket](err):\n\t\t\treturn nil, fmt.Errorf(errS3NoSuchBucket, c.bucketName, err)\n\t\tcase IsA[*s3types.NotFound](err):\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"Unable to access object %q in S3 bucket %q: %w\", c.path, c.bucketName, err)\n\t}\n\n\t// Pre-allocate the full buffer to avoid re-allocations and GC\n\tbuf := make([]byte, int(aws.ToInt64(headOut.ContentLength)))\n\tw := manager.NewWriteAtBuffer(buf)\n\n\tdownloadInput := &s3.GetObjectInput{\n\t\tBucket: aws.String(c.bucketName),\n\t\tKey:    aws.String(c.path),\n\t}\n\tif c.serverSideEncryption && c.customerEncryptionKey != nil {\n\t\tdownloadInput.SSECustomerKey = aws.String(base64.StdEncoding.EncodeToString(c.customerEncryptionKey))\n\t\tdownloadInput.SSECustomerAlgorithm = aws.String(s3EncryptionAlgorithm)\n\t\tdownloadInput.SSECustomerKeyMD5 = aws.String(c.getSSECustomerKeyMD5())\n\t}\n\n\tdownloader := manager.NewDownloader(c.s3Client)\n","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/s3/client.go#L128-L164","documentation":"Thrown in RemoteClient.get() (s3/client.go:146) when HeadObject fails with an error that is neither NoSuchBucket nor *s3types.NotFound. The wrapped (%w) error is the raw AWS SDK error, so its code is inspectable. This is the catch-all for any HEAD-object access problem on an existing bucket.","triggerScenarios":"s3:GetObject denied (AccessDenied); SSE-C customer key missing or wrong (InvalidArgument/403); KMS key denied (kms:Decrypt missing); S3 throttling (SlowDown); network error; object stored with a checksum algorithm the SDK rejects.","commonSituations":"Least-privilege role missing s3:GetObject; bucket encrypted with customer-provided keys but SSE-C key not configured; KMS-encrypted state with no kms:Decrypt grant; cross-account object owned by another account.","solutions":["Grant s3:GetObject on the state object (and kms:Decrypt on the KMS key if SSE-KMS is used).","If using SSE-C, supply the correct customer key in the backend config.","Retry on SlowDown/throttling with backoff.","Use object ownership controls / ACLs so the caller can read cross-account objects."],"exampleFix":"// before: role lacks kms:Decrypt on the CMK\n\n// after: attach a KMS grant/key policy allowing the role to decrypt\n// {\n//   \"Effect\": \"Allow\",\n//   \"Action\": [\"kms:Decrypt\", \"kms:DescribeKey\"],\n//   \"Resource\": \"arn:aws:kms:us-west-2:111122223333:key/<key-id>\"\n// }","handlingStrategy":"validation","validationCode":"// Probe read access (and KMS) on the state object before the run\n// _, err := s3Client.HeadObject(ctx, &s3.HeadObjectInput{Bucket:&bucket, Key:aws.String(stateKey)})\n// if err != nil { /* fix s3:GetObject / kms:Decrypt / SSE-C key */ }","typeGuard":"// Narrow the wrapped error to react by AWS error code\n// var apiErr smithy.APIError\n// if errors.As(err, &apiErr) {\n//   switch apiErr.ErrorCode() {\n//   case \"AccessDenied\":   /* IAM / KMS / SSE-C */\n//   case \"InvalidArgument\":/* SSE-C key problem */\n//   case \"SlowDown\":       /* retry */\n//   }\n// }","tryCatchPattern":"// Distinguish retryable throttling from hard permission errors\n// var apiErr smithy.APIError\n// if errors.As(err, &apiErr) && apiErr.ErrorCode()==\"SlowDown\" { /* backoff */ } else { return err }","preventionTips":["Grant s3:GetObject plus kms:Decrypt (SSE-KMS) on the state path.","Configure the correct SSE-C customer key if using customer keys.","Avoid cross-account object ownership without explicit ACL/policy."],"tags":["s3","aws","permissions","iam","encryption"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}