Add a aws_s3_access_point_policy resource to prevent cycle errors

[ghost]

This issue was originally opened by @AlexEshoo as hashicorp/terraform#24258. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Current Terraform Version

Terraform v0.12.21
+ provider.aws v2.51.0

Use-cases

When creating an AWS S3 Access Point, a common task is to attach a policy to the access point.
Terraform provides this with the policy attribute of the aws_s3_access_point resource, but it cannot be used with the aws_iam_policy_document datasource when the document references the ARN of the access point without causing cycle errors.

Attempted Solutions

resource "aws_s3_access_point" "test_access_point" {
  bucket = aws_s3_bucket.my_bucket.id
  name   = "test"
  policy = data.aws_iam_policy_document.test_access_point_policy_doc.json
}

data "aws_iam_policy_document" "test_access_point_policy_doc" {
  statement {
    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.my_role.arn]
    }
    effect    = "Allow"
    actions   = ["s3:ListBucket"]
    resources = [aws_s3_access_point.test_access_point.arn]
    condition {
      test     = "StringLike"
      variable = "s3:prefix"
      values   = ["test/*"]
    }
  }
}

This causes cycle errors due to the circular reference.

Proposal

This problem is resolved for the aws_s3_bucket resource by having a separate resource named aws_s3_bucket_policy that can be used to link the two resources without circular references. An example is demonstrated here

The proposal would be to create a similar aws_s3_access_point_policy resource that would handle updating the policy on the access point after creation.

References

• Cycle when creating bucket with policy terraform#5612

[ewbankkit]

Related:

• S3 Access Points support #11123

[ewbankkit]

Note that the new resource will be named aws_s3control_access_point_policy to conform with new resource naming guidelines.

Also, until the next major version of the Terraform AWS Provider (v4.0.0), note that the lifecycle.ignore_changes meta-argument will need to be used on the aws_s3_access_point resource to prevent permanent diffs for the policy argument.

[github-actions]

This functionality has been released in v3.66.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.