{"record":{"id":"c75f727b51a26325","repo":"hashicorp/terraform","slug":"unable-to-access-object-q-in-s3-bucket-q-w","errorCode":null,"errorMessage":"Unable to access object %q in S3 bucket %q: %w","messagePattern":"Unable to access object %q in S3 bucket %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/s3/client.go","lineNumber":146,"sourceCode":"\theadInput := &s3.HeadObjectInput{\n\t\tBucket: aws.String(c.bucketName),\n\t\tKey:    aws.String(c.path),\n\t}\n\tif c.serverSideEncryption && c.customerEncryptionKey != nil {\n\t\theadInput.SSECustomerKey = aws.String(base64.StdEncoding.EncodeToString(c.customerEncryptionKey))\n\t\theadInput.SSECustomerAlgorithm = aws.String(s3EncryptionAlgorithm)\n\t\theadInput.SSECustomerKeyMD5 = aws.String(c.getSSECustomerKeyMD5())\n\t}\n\n\theadOut, err := c.s3Client.HeadObject(ctx, headInput)\n\tif err != nil {\n\t\tswitch {\n\t\tcase IsA[*s3types.NoSuchBucket](err):\n\t\t\treturn nil, fmt.Errorf(errS3NoSuchBucket, c.bucketName, err)\n\t\tcase IsA[*s3types.NotFound](err):\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"Unable to access object %q in S3 bucket %q: %w\", c.path, c.bucketName, err)\n\t}\n\n\t// Pre-allocate the full buffer to avoid re-allocations and GC\n\tbuf := make([]byte, int(aws.ToInt64(headOut.ContentLength)))\n\tw := manager.NewWriteAtBuffer(buf)\n\n\tdownloadInput := &s3.GetObjectInput{\n\t\tBucket: aws.String(c.bucketName),\n\t\tKey:    aws.String(c.path),\n\t}\n\tif c.serverSideEncryption && c.customerEncryptionKey != nil {\n\t\tdownloadInput.SSECustomerKey = aws.String(base64.StdEncoding.EncodeToString(c.customerEncryptionKey))\n\t\tdownloadInput.SSECustomerAlgorithm = aws.String(s3EncryptionAlgorithm)\n\t\tdownloadInput.SSECustomerKeyMD5 = aws.String(c.getSSECustomerKeyMD5())\n\t}\n\n\tdownloader := manager.NewDownloader(c.s3Client)\n","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/s3/client.go#L128-L164","documentation":"Thrown by RemoteClient.Get in the S3 backend when HeadObject errors and the error is neither NoSuchBucket nor *s3types.NotFound. It is the catch-all head-object failure, wrapping the underlying error with %w. Means the bucket is reachable but the HEAD on the specific key failed for another reason.","triggerScenarios":"HeadObject errors, IsA[*s3types.NoSuchBucket] false, IsA[*s3types.NotFound] false. Causes: 403 AccessDenied on the key (encrypted differently / different SSE-C key), KMS key inaccessible, throttling, or transient 5xx.","commonSituations":"SSE-C state read with a missing/wrong customer key; SSE-KMS with the KMS key disabled or policy denying decrypt; s3:GetObject permission missing on the key; throttling on a hot prefix.","solutions":["If using SSE-C, supply the correct customer key configuration on every read.","If using SSE-KMS, verify the KMS key is enabled and the principal has kms:Decrypt.","Grant `s3:GetObject` on the state key ARN to the principal.","Retry on throttling (SlowDown) with exponential backoff."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: if SSE-C is in use, ensure the customer key is provided\nif c.serverSideEncryption && c.customerEncryptionKey == nil {\n    return fmt.Errorf(\"state is SSE-C but no customer key configured\")\n}","typeGuard":"func isAccessDenied(err error) bool {\n    var ae smithy.APIError\n    return errors.As(err, &ae) && ae.ErrorCode()==\"AccessDenied\"\n}","tryCatchPattern":"headOut, err := c.s3Client.HeadObject(ctx, headInput)\nif err != nil {\n    var ae smithy.APIError\n    if errors.As(err, &ae) && ae.ErrorCode()==\"AccessDenied\" { return nil, fmt.Errorf(\"missing GetObject/KMS Decrypt on %s: %w\", c.path, err) }\n    return nil, err\n}","preventionTips":["Grant s3:GetObject plus kms:Decrypt on the state resources.","Provide the SSE-C customer key consistently across runs.","Keep the KMS key policy permissive to the principal."],"tags":["s3","aws","head-object","sse-c","permissions","kms"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}