Terraformで"Error deleting S3 notification configuration: OperationAborted"エラーが出力された時の対応

こんにちわ

がじぇったー (@hackmylife7) | Twitter

です。

Terraformでちょっとハマったので対応方法をメモに残しておきます。

TL;DR(要約)

• S3に対するS3バケットポリシーとバケットのS3パブリックアクセスブロックを同時に作成するとTerraform apply/destroy時にエラーになります
• そのためdepends onを用い作成順序を制御する必要があります

Before(エラーが発生していたS3のリソース定義)

s3.tf

/* ====================
Resources
==================== */
/*
ALBのアクセスログを保管するS3バケット
*/

data "aws_iam_policy_document" "alb-log" {
  statement {
    actions = [
      "s3:PutObject",
    ]

    resources = [
      "arn:aws:s3:::${var.default.site}-${var.default.env}-lb-log/*",
    ]
    principals {
      type        = "AWS"
      identifiers = ["account_idが入る"]
    }
  }
}

resource "aws_s3_bucket_public_access_block" "alb-log" {
  bucket                  = aws_s3_bucket.alb-log.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket" "alb-log" {
  # force_destroy = true
  bucket = "${var.default.site}-${var.default.env}-lb-log"
  acl    = "private"
  versioning {
    enabled = true
  }
  policy = data.aws_iam_policy_document.alb-log.json
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.alb-log.id
  lambda_function {
    lambda_function_arn = aws_lambda_function.alb_logger.arn
    events              = ["s3:ObjectCreated:*"]
  }
}

上記のリソース定義で、terraform apply/destroyを実行すると aws_s3_bucket_public_access_blockとaws_s3_bucket_notificationの実行/削除命令が競合し、実行に失敗します

エラー内容

Error: Error deleting S3 notification configuration: OperationAborted: A conflicting conditional operation is currently in progress against this resource. Please try again

After

aws_s3_bucket_public_access_blockブロックにdepends on 変数で実行順序を制御します

s3.tf

/* ====================
Resources
==================== */
/*
ALBのアクセスログを保管するS3バケット
*/

data "aws_iam_policy_document" "alb-log" {
  statement {
    actions = [
      "s3:PutObject",
    ]

    resources = [
      "arn:aws:s3:::${var.default.site}-${var.default.env}-lb-log/*",
    ]
    principals {
      type        = "AWS"
      identifiers = ["account_idが入る"]
    }
  }
}

resource "aws_s3_bucket_public_access_block" "alb-log" {

  #--------------------------------------------------------------------------------
  # To avoid OperationAborted: A conflicting conditional operation is currently in progress
  #--------------------------------------------------------------------------------
  depends_on = [
    aws_s3_bucket_notification.bucket_notification
  ]


  bucket                  = aws_s3_bucket.alb-log.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket" "alb-log" {
  # force_destroy = true
  bucket = "${var.default.site}-${var.default.env}-lb-log"
  acl    = "private"
  versioning {
    enabled = true
  }
  policy = data.aws_iam_policy_document.alb-log.json
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.alb-log.id
  lambda_function {
    lambda_function_arn = aws_lambda_function.alb_logger.arn
    events              = ["s3:ObjectCreated:*"]
  }
}

以上です