add locking support to the -write policy

terraform-modules · Aug 27, 2025 · 4dba20e · 4dba20e
1 parent d6f1a1b
commit 4dba20e
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/terraform-state/policy.tf b/terraform-state/policy.tf
@@ -58,7 +58,6 @@ data "aws_iam_policy_document" "tfstate" {
   }
 
   # https://developer.hashicorp.com/terraform/language/backend/s3
-
   statement {
     sid       = "TFRemoteStateLocking"
     effect    = "Allow"
@@ -175,6 +174,17 @@ data "aws_iam_policy_document" "tfstate_write" {
     ]
     resources = ["${aws_s3_bucket.tfstate.arn}/*"]
   }
+  # https://developer.hashicorp.com/terraform/language/backend/s3
+  statement {
+    sid       = "TFRemoteStateLocking"
+    effect    = "Allow"
+    resources = ["${aws_s3_bucket.tfstate.arn}/*.tflock"]
+    actions = [
+      #      "s3:GetObject",
+      #      "s3:PutObject"
+      "s3:DeleteObject"
+    ]
+  }
   statement {
     sid    = "TFRemoteStateDDB"
     effect = "Allow"