bincyber/terraform-aws-remote-state

Terraform module to setup remote state for AWS

terraform-aws-remote-state's Issues

Not able to use terraform_rw_access group for table locking

While trying to run terraform commands as a user attached to the terraform_rw_access group, I was getting:

Error: Error locking state: Error acquiring the state lock: 2 error(s) occurred:

* AccessDeniedException: User: arn:aws:iam::[account_num]:user/[user_name] is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:[region]:[account_num]:table/[table_name]
	status code: 400, request id: blahblah
* AccessDeniedException: User: arn:aws:iam::[account_num]:user/[user_name] is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:[region]:[account_num]:table/[table_name]
	status code: 400, request id: blahblah

I was able to fix it by adding in the account number explicitly:

data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "dynamodb_table" {
  statement {
    sid    = "AllowRWDynamoDBTable"
    effect = "Allow"

    actions = [
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteItem",
    ]

    resources = [
      "arn:aws:dynamodb:${var.region}:${data.aws_caller_identity.current.account_id}:table/${local.dynamodb_table_name}",
    ]
  }
}

I'm happy to make a PR with the change is that sounds like a good fix for you.