add s3:DeleteObject for *.tflock to enable lockign in 1.9.x

terraform-modules · Aug 27, 2025 · d6f1a1b · d6f1a1b
1 parent 9f808fc
commit d6f1a1b
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -420,3 +420,4 @@
 * 2.12.3 -- 2025-08-27
   - terraform-state
     - remove role creation for application_mode
+    - add s3:DeleteObject for *.tflock to enable lockign in 1.9.x
diff --git a/terraform-state/policy.tf b/terraform-state/policy.tf
@@ -57,6 +57,19 @@ data "aws_iam_policy_document" "tfstate" {
     ]
   }
 
+  # https://developer.hashicorp.com/terraform/language/backend/s3
+
+  statement {
+    sid       = "TFRemoteStateLocking"
+    effect    = "Allow"
+    resources = ["${aws_s3_bucket.tfstate.arn}/*.tflock"]
+    actions = [
+      #      "s3:GetObject",
+      #      "s3:PutObject"
+      "s3:DeleteObject"
+    ]
+  }
+
   statement {
     sid       = "TFRemoteStateDDB"
     effect    = "Allow"