AuthorizationHeaderMalformed for S3 remote

[rvangundy]

I'm using S3 remote and configuring with the following command:

terraform remote config -backend=S3 -backend-config="bucket=test" -backend-config="key=terraform.tfstate" -backend-config="region=us-east-1"

And getting the following error:

Error reloading remote state: AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'eu-west-1'
    status code: 400, request id: []

I'm using the same access and secret keys that I normally use so this seems like a bug in the way Terraform is authorizing with S3.

[phinze]

@rvangundy that's definitely a weird one - when you hit this error, do you have AWS_REGION or AWS_DEFAULT_REGION env vars set? Just trying to figure out the steps to reproduce.

[rvangundy]

No longer having this issue as of the latest version of Terraform.

[jdamick]

@rvangundy what version did it go away? i'm using 0.6.3 and i'm seeing the same issue:

* aws_s3_bucket.registry-bucket: Error creating S3 bucket: AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'eu-west-1'
    status code: 400, request id: []

Not sure where eu-west-1 is coming from, i'm setting the aws provider region to us-east-1..

i also do not have AWS_REGION or AWS_DEFAULT_REGION set.

[jdamick]

I think the issue is due to the bucket i was trying to create already existed in eu-west-1..

[jcardinal]

Adding my 2¢ to clarify for anyone else having this same problem. I wrongly assumed S3 bucket names were unique to a given AWS account. I tried creating my bucket manually in the console and got the following error: The requested bucket name is not available. The bucket namespace is shared by all users of the system. Please select a different name and try again.

If only the API error were as clear!

[rmurillo21]

Issue still exists. It appears to be related referencing a bucket name that already exists in a different account, as @jcardinal suggested. To reproduce, "terraform-state" as the bucket name, it will generate the above error.

[loekj]

@rmurillo21 Correct it still does. I just had the issue and after much searching and digging I found it it too was about the unique S3 bucket name.
To fix, it should scan whether bucket.name already exists globally and throw an appropriate error instead of a completely misleading one.

[CruzanCaramele]

hi there, the issue still exists, I am getting the error :

* aws_s3_bucket.db-backup-bucket: Error creating S3 bucket: AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'us-west-2'

[rj-reilly]

I had same issue, i had created the bucket previously and deleted it. I changed the name and it applied no problem.

[apatrida]

Yes, that's the issue. If you create the bucket in region ABC and then delete it, you cannot create the bucket in region XYZ, otherwise you have this error. Rename bucket, no more errors.

[bharathiraja29]

This error is thrown only when you try to create a bucket which is already used. May be somebody else. S3 bucket names are globally unique. Better solution would be using bucket_prefix variables.

[praveenchaudhary0602]

I am also facing the similar issue , My bucket is in us-east-1 (printed the same and available in the console ) .I have tried using the
s3.setRegion(com.amazonaws.regions.Region.getRegion(Regions.US_EAST_1));

and also created the bucket with unique name also but doesn't work . Let me know if any way I need to try .

[mveeramuthu]

Hi,
I also still face this. Could you please re-open this ticket?

Error applying plan:

1 error(s) occurred:

* aws_s3_bucket.s3_bucket_with_policy[9]: 1 error(s) occurred:

* aws_s3_bucket.s3_bucket_with_policy.9: Error creating S3 bucket: AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'eu-west-1'

[kmcquade]

Facing this as well. With a bucket created in us-east-1... error is "AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'ap-southeast-2'"

[kmcquade]

Ok. Determined that this issue occurred when I changed state buckets. The local .terraform/terraform.tfstate kept the same state bucket name so it was trying to authenticate to a different bucket. Not sure why it didn't clear the name of the first state bucket when I altered the state config, but that's the issue for me. Fixed, but I suggest taking a look at why this happens.

[NathanZook]

Not fun hitting this within the first couple of hours of trying to use terraform...

[bflad]

Hi @NathanZook 👋 Sorry you ran into trouble. Can you please open a new issue filling out the details? From glancing above it looks like there are a few unrelated actions with similar error messaging, so we would love to narrow down any lingering issues and clear them out. Thanks.

[isaacegglestone]

Terraform docs, getting started guide:
https://www.terraform.io/intro/getting-started/dependencies.html

To recreate the problem just deploy the terraform on the above linked page.

Everyone is cutting and pasting and getting the same bucket name. Thus why most everyone discovers this within the first few hours of using terraform.

Its quite comical when you think about it.

Interm solution: Update documentation so the line reads:

bucket = "terraform-getting-started-guide-<insert your unique id here>"

Better longer term solution: Append error to read "Or you might have a bucket with an already used name, try appending a unique variable to the bucket name"

I have proved this works. Sorry no time to do a pull request on the docs but thought I would add this so hopefully someone does.

[daraul]

Can confirm I encountered this while testing terraform, then felt like an idiot when I realized there's no way that bucket name is still available. Still, though, can't we get a better error message when this happens?

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.