AWS s3_object resource now requires s3:GetObjectTagging permission

[ljfranklin]

Starting with Terraform version 0.8.7, the s3_object resource now requires the s3:GetObjectTagging permission even if no tags are specified in your TF configuration files. Probably introduced in this PR. The error message (shown below) is unfortunately not helpful as it doesn't mention what new permission you need.

Could the new s3 tagging code be updated to swallow 403 errors when trying to retrieve the tags for an object, or update docs somewhere to list this as a required permission?

Thanks!

Terraform Version

0.8.7

Affected Resource(s)

• s3_object

Error

aws_s3_bucket_object.s3_object: AccessDenied: Access Denied
  	status code: 403, request id: 599D98A31E927E6E

[ewbankkit]

Swallowing the error seems a bit "dangerous" to me - If a 403 was swallowed and assumed no tags then for example terraform plan could show changes when there shouldn't be.
I agree that changes to IAM permissions should be recorded and communicated somehow.
I'll have the same problem with #12243.

[radeksimko]

Hi @ljfranklin
I understand this has caused inconvenience to mindful users like you that are very strict about crafting IAM policies - sorry for that. Can you explain further why is it dangerous/risky or not possible in your environment to add read permission for reading tags?

I would agree that requiring new write or even delete permissions or resource-agnostic permissions in general (not scoped to resources, like S3 bucket name) would be undesirable, but I'm struggling to understand the problem or context here specifically.

I agree with @ewbankkit that ignoring 403 error would cause confusions to users that do want to use tags and just might forgot to setup the right policies.

The error message (shown below) is unfortunately not helpful as it doesn't mention what new permission you need.

I agree, unfortunately that's all we get from the AWS API, many errors are as brief as this one. That said I opened #12759 - feedback welcomed there.

[ljfranklin]

Can you explain further why is it dangerous/risky or not possible in your environment to add read permission for reading tags?

No problem with adding it, the main issue was it took a bit of time to figure out exactly which new permission was required to avoid the error. But your PR seems to have given a much nicer error now, so I think we're good to close this out.

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.