josh-keller
commented
11 months ago I believe I may be encountering a similar issue
Terraform v1.5.7
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v5.24.0
+ provider registry.terraform.io/hashicorp/external v2.3.1
+ provider registry.terraform.io/hashicorp/null v3.2.1I am listing objects in a bucket and then getting details about each:
data "aws_s3_objects" "ova_objects" {
bucket = var.src_bucket
prefix = var.prefix
}
data "aws_s3_object" "object_details" {
for_each = toset(data.aws_s3_objects.ova_objects.keys)
bucket = var.src_bucket
key = each.value
}The aws_s3_objects works fine and all but one of the aws_s3_object requests works. But one errors with this:
Error: downloading S3 Bucket ([redacted]-us-west-2-[redacted]) Object (<object-prefix>/encrypt_password.txt): operation error S3: GetObject, https response error StatusCode: 403, RequestID: ***************, HostID: *************, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.I've researched other causes of this problem like clock sync and credentials issues. I've ruled those out because all my other requests succeed. I have other prefixes that have similar files in them. The requests also fail on the encrypt_password.txt file in those key prefixes as well.
Is it possible there is a bug in the signature generation?
lambbuster
Echeoss
rahul6941
Terraform Version
Terraform Configuration Files
Debug Output
Expected Behavior
Terraform should be able to refresh the state and initialise properly.
Actual Behavior
Terraform attempts to refresh the state (GetObject) and a SignatureDoesNotMatch error is thrown.
Steps to Reproduce
Additional Context
Terraform 1.6.0 is not able to refresh an existing state file after first run for a new state held in an s3 backend.
The first run is able to perform the ListBucketsV2, HeadObject and PutObject operations to init and apply. On subsequent runs, the ListBucketsV2 and HeadObject operations are successful, but the GetObject operation fails (HeadObject returns that an object with the key name is present) with a SignatureDoesNotMatch error.
This behaviour is only observed when running Terraform locally. When the same execution is made via a jenkins pipeline, no issue occurs. The only difference between the two is that our jenkins pipeline gets session credentials via an assume-role CLI call and exports them to environment variables, whereas locally we are using a federated AD role to gain session credentials.
I have tried numerous configurations for the s3 backend:
My only summary is that the signature for the GetObject request is not being created properly. From debug logs i can see the session credentials are received correctly whichever way I configure the backend, so I don't believe the issue is in this area. It's just that GetObject call that Terraform doesn't like!
NOTE: The exact same configuration works perfectly if I switch back to either version 1.3.1 or 1.5.3 (these are the only other pre-1.6.x versions available to us).
Any help would be greatly appreciated.
References
No response