{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/2432","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/2432/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/2432/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/2432/events","html_url":"https://github.com/hashicorp/terraform/issues/2432","id":90387068,"number":2432,"title":"providers/aws: resource aws_s3_bucket keeps modifying policy","user":{"login":"pmoust","id":2493339,"avatar_url":"https://avatars.githubusercontent.com/u/2493339?v=3","gravatar_id":"","url":"https://api.github.com/users/pmoust","html_url":"https://github.com/pmoust","followers_url":"https://api.github.com/users/pmoust/followers","following_url":"https://api.github.com/users/pmoust/following{/other_user}","gists_url":"https://api.github.com/users/pmoust/gists{/gist_id}","starred_url":"https://api.github.com/users/pmoust/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmoust/subscriptions","organizations_url":"https://api.github.com/users/pmoust/orgs","repos_url":"https://api.github.com/users/pmoust/repos","events_url":"https://api.github.com/users/pmoust/events{/privacy}","received_events_url":"https://api.github.com/users/pmoust/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-23T13:20:14Z","updated_at":"2015-06-23T14:19:21Z","closed_at":null,"body":"Repro:\r\n\r\na. foobar.tf\r\n```\r\nresource \"aws_s3_bucket\" \"foobar\" {\r\n    bucket  = \"foobar666\"\r\n    acl     = \"private\"\r\n    policy  = \"${file(\"detailed_billing_s3.json\")}\"\r\n    tags {\r\n        Name = \"Billing Reports\"\r\n    }\r\n}\r\n```\r\n\r\nb. detailed_billing_s3.json\r\n```json\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n  {\r\n    \"Effect\": \"Allow\",\r\n    \"Principal\": {\r\n      \"AWS\": \"386209384616\"\r\n    },\r\n    \"Action\": [\r\n      \"s3:GetBucketAcl\",\r\n      \"s3:GetBucketPolicy\"\r\n    ],\r\n    \"Resource\": \"arn:aws:s3:::foobar666\"\r\n  },\r\n  {\r\n    \"Effect\": \"Allow\",\r\n    \"Principal\": {\r\n      \"AWS\": \"386209384616\"\r\n    },\r\n    \"Action\": \"s3:PutObject\",\r\n    \"Resource\": \"arn:aws:s3:::foobar666/*\"\r\n  }\r\n  ]\r\n}\r\n```\r\n\r\nProduced state:\r\nstate\r\n```json\r\n{\r\n    \"version\": 1,\r\n    \"serial\": 3,\r\n    \"modules\": [\r\n        {\r\n            \"path\": [\r\n                \"root\"\r\n            ],\r\n            \"outputs\": {},\r\n            \"resources\": {\r\n                \"aws_s3_bucket.foobar\": {\r\n                    \"type\": \"aws_s3_bucket\",\r\n                    \"primary\": {\r\n                        \"id\": \"foobar666\",\r\n                        \"attributes\": {\r\n                            \"acl\": \"private\",\r\n                            \"bucket\": \"foobar666\",\r\n                            \"force_destroy\": \"false\",\r\n                            \"hosted_zone_id\": \"Z3AQBSTGFYJSTF\",\r\n                            \"id\": \"foobar666\",\r\n                            \"policy\": \"{\\\"Statement\\\":[{\\\"Action\\\":[\\\"s3:GetBucketAcl\\\",\\\"s3:GetBucketPolicy\\\"],\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::386209384616:root\\\"},\\\"Resource\\\":\\\"arn:aws:s3:::foobar666\\\",\\\"Sid\\\":\\\"\\\"},{\\\"Action\\\":\\\"s3:PutObject\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::386209384616:root\\\"},\\\"Resource\\\":\\\"arn:aws:s3:::foobar666/*\\\",\\\"Sid\\\":\\\"\\\"}],\\\"Version\\\":\\\"2012-10-17\\\"}\",\r\n                            \"region\": \"us-east-1\",\r\n                            \"tags.#\": \"1\",\r\n                            \"tags.Name\": \"Billing Reports\",\r\n                            \"website.#\": \"0\",\r\n                            \"website_endpoint\": \"\"\r\n                        }\r\n                    }\r\n                }\r\n            }\r\n        }\r\n    ]\r\n}\r\n```\r\n\r\nPlan keeps giving:\r\n```\r\n~ aws_s3_bucket.foobar\r\n    policy: \"{\\\"Statement\\\":[{\\\"Action\\\":[\\\"s3:GetBucketAcl\\\",\\\"s3:GetBucketPolicy\\\"],\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::386209384616:root\\\"},\\\"Resource\\\":\\\"arn:aws:s3:::foobar666\\\",\\\"Sid\\\":\\\"\\\"},{\\\"Action\\\":\\\"s3:PutObject\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::386209384616:root\\\"},\\\"Resource\\\":\\\"arn:aws:s3:::foobar666/*\\\",\\\"Sid\\\":\\\"\\\"}],\\\"Version\\\":\\\"2012-10-17\\\"}\" => \"{\\\"Statement\\\":[{\\\"Action\\\":[\\\"s3:GetBucketAcl\\\",\\\"s3:GetBucketPolicy\\\"],\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"386209384616\\\"},\\\"Resource\\\":\\\"arn:aws:s3:::foobar666\\\"},{\\\"Action\\\":\\\"s3:PutObject\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"386209384616\\\"},\\\"Resource\\\":\\\"arn:aws:s3:::foobar666/*\\\"}],\\\"Version\\\":\\\"2012-10-17\\\"}\"\r\n```\r\n\r\nThe actual policy on bucket is;\r\n```json\r\n{\r\n    \"Policy\": \"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Sid\\\":\\\"\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::386209384616:root\\\"},\\\"Action\\\":[\\\"s3:GetBucketAcl\\\",\\\"s3:GetBucketPolicy\\\"],\\\"Resource\\\":\\\"arn:aws:s3:::foobar666\\\"},{\\\"Sid\\\":\\\"\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::386209384616:root\\\"},\\\"Action\\\":\\\"s3:PutObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::foobar666/*\\\"}]}\"\r\n}\r\n```\r\n\r\nAm I forced to be verbose about `Principal` and give its ARN instead of just account no.?\r\n\r\nShould this be handled by the Create/Update func of `aws_s3_bucket`?"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/114520908","html_url":"https://github.com/hashicorp/terraform/issues/2432#issuecomment-114520908","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/2432","id":114520908,"user":{"login":"pmoust","id":2493339,"avatar_url":"https://avatars.githubusercontent.com/u/2493339?v=3","gravatar_id":"","url":"https://api.github.com/users/pmoust","html_url":"https://github.com/pmoust","followers_url":"https://api.github.com/users/pmoust/followers","following_url":"https://api.github.com/users/pmoust/following{/other_user}","gists_url":"https://api.github.com/users/pmoust/gists{/gist_id}","starred_url":"https://api.github.com/users/pmoust/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmoust/subscriptions","organizations_url":"https://api.github.com/users/pmoust/orgs","repos_url":"https://api.github.com/users/pmoust/repos","events_url":"https://api.github.com/users/pmoust/events{/privacy}","received_events_url":"https://api.github.com/users/pmoust/received_events","type":"User","site_admin":false},"created_at":"2015-06-23T14:19:21Z","updated_at":"2015-06-23T14:19:21Z","body":"@phinze solution was to use the following verbose policy.\r\n```json\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Sid\": \"\",\r\n      \"Effect\": \"Allow\",\r\n      \"Principal\": {\r\n        \"AWS\": \"arn:aws:iam::386209384616:root\"\r\n      },\r\n      \"Action\": [\r\n        \"s3:GetBucketAcl\",\r\n        \"s3:GetBucketPolicy\"\r\n      ],\r\n      \"Resource\": \"arn:aws:s3:::foobar666\"\r\n    },\r\n    {\r\n      \"Sid\": \"\",\r\n      \"Effect\": \"Allow\",\r\n      \"Principal\": {\r\n        \"AWS\": \"arn:aws:iam::386209384616:root\"\r\n      },\r\n      \"Action\": \"s3:PutObject\",\r\n      \"Resource\": \"arn:aws:s3:::foobar666/*\"\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\n I don't know if it's worth spending engineering time to fix this. It would certainly make UX better for us."}}