How to update existing s3 bucket policy using Terraform?

Question

Hi all

How can I update existing s3 bucket policy using Terraform? I need to add a policy to the existing S3 bucket policy using Terraform.

Thanks.

Sonic · Accepted Answer

Comments to myself: Data "aws_s3_bucket_policy" supports "policy" attribute, so the following works.

```
# Data source to read the existing bucket policy
data "aws_s3_bucket_policy" "existing_policy" {
  bucket = var.source_bucket_name
}

# Create a new bucket policy to update
data "aws_iam_policy_document" "policy_1" {
  statement {
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [var.lambda_loader_role_arn]
    }
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:PutObjectAcl"
    ]
    resources = ["arn:aws:s3:::${var.source_bucket_name}/*"]
  }
}

# Create a merged bucket policy document
data "aws_iam_policy_document" "merged_policy" {
  source_policy_documents = [data.aws_s3_bucket_policy.existing_policy.policy, data.aws_iam_policy_document.policy_1.json]
}

# Update the bucket policy
resource "aws_s3_bucket_policy" "update" {
	bucket = var.source_bucket_name
	policy = data.aws_iam_policy_document.merged_policy.json
}
```

re:Post Agent · Answer

To update an existing S3 bucket policy using Terraform, you can use the `aws_s3_bucket_policy` resource. Here's how you can approach this:

1. First, retrieve the existing bucket policy using a data source or by importing the existing policy into your Terraform state.

2. Then, define the `aws_s3_bucket_policy` resource in your Terraform configuration, referencing the existing bucket.

3. In the policy attribute of this resource, include both the existing policy statements and the new policy you want to add.

Here's an example of how your Terraform code might look:

```hcl
resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.your_bucket.id

policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        // Existing policy statements here
      },
      {
        // New policy statement to add
        Sid    = "NewPolicyStatement"
        Effect = "Allow"
        Principal = {
          Service = "some-aws-service.amazonaws.com"
        }
        Action   = ["s3:SomeAction"]
        Resource = ["${aws_s3_bucket.your_bucket.arn}/*"]
      }
    ]
  })
}
```

In this example, you would replace the placeholder comments with your actual existing policy statements and the new policy statement you want to add.

Remember that Terraform will replace the entire bucket policy when you apply this configuration. Therefore, it's crucial to include all desired policy statements, both existing and new, in the policy attribute.

If you need to make the policy more dynamic or complex, you can use Terraform's template functionality or create the policy JSON using a separate data source and reference it in the `aws_s3_bucket_policy` resource.

Always review the planned changes carefully before applying them to ensure you're not inadvertently removing or modifying existing permissions that you want to keep.  
**Sources**  
[Restrict actions with any Principal for S3 buckets | Amazon Q, Detector Library](https://docs.aws.amazon.com/codeguru/detector-library/terraform/restrict-s3-principal-action-terraform/index.html)  
[S3 modify bucket policy using boto/boto3 | AWS re:Post](https://repost.aws/questions/QU0CffbvVeTTuO2yYrnRlurA/s3-modify-bucket-policy-using-boto-boto3)

Riku_Kobayashi · Answer

Hello.

You can also use "Import" to import an already configured bucket policy into Terraform and then edit it.  
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy  
https://developer.hashicorp.com/terraform/cli/import

How to update existing s3 bucket policy using Terraform?

Add your answer

Relevant content