Terraform does not detect changes outside

[EugenKon]

Terraform and AWS Provider Version

Terraform v1.11.4
on darwin_arm64

Affected Resource(s) or Data Source(s)

• aws_s3_bucket_acl
• aws_s3_bucket_public_access_block
• aws_s3_bucket_ownership_controls

Expected Behavior

Terraform should detect outside changes and print them as

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply" which
may have affected this plan:

Having IDs of objects inside tfstate the changes could be automatically synced.

Actual Behavior

It tried to create/destroy resources

  # module.private-cloud.aws_s3_bucket_public_access_block.users-s3 will be created
  + resource "aws_s3_bucket_public_access_block" "users-s3" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = "XXXXX"
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.private-cloud.aws_s3_bucket_ownership_controls.iguides-s3 will be created
  + resource "aws_s3_bucket_ownership_controls" "users-s3" {
      + bucket = "XXXX"
      + id     = (known after apply)

      + rule {
          + object_ownership = "BucketOwnerEnforced"
        }
    }

  # module.private-cloud.aws_s3_bucket_acl.users[0] will be destroyed
  # (because aws_s3_bucket_acl.users is not in configuration)
  - resource "aws_s3_bucket_acl" "users" {
      - acl                   = "private" -> null
      - bucket                = "XXXXX" -> null
      - expected_bucket_owner = "XXXX" -> null
      - id                    = "uXXXXXX,XXXXX,private" -> null

      - access_control_policy {
          - grant {
              - permission = "FULL_CONTROL" -> null

              - grantee {
                  - display_name  = "aws" -> null
                  - id            = "XXXXX" -> null
                  - type          = "CanonicalUser" -> null
                    # (2 unchanged attributes hidden)
                }
            }
          - owner {
              - display_name = "aws" -> null
              - id           = "XXXXX" -> null
            }
        }
    }

Relevant Error/Panic Output

Sample Terraform Configuration

+resource "aws_s3_bucket_public_access_block" "users-s3" {
  bucket = aws_s3_bucket.users-s3.id

  block_public_acls       = true
  block_public_policy     = true
  restrict_public_buckets = true
  ignore_public_acls      = true
}

-resource "aws_s3_bucket_acl" "users" {
  count = var.project_name == "essentials" ? 1: 0

  bucket                = aws_s3_bucket.users-s3.id
  expected_bucket_owner = data.aws_caller_identity.current.account_id
  acl                   = "private"
}

+resource "aws_s3_bucket_ownership_controls" "users-s3" {
  bucket = aws_s3_bucket.users-s3.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

- -- removed configuration
+ -- added configuration

Steps to Reproduce

1. Change bucket configuration from here to here:
   
   
   and
   
   
2. Terraform plan/apply

Debug Logging

Click to expand log output

GenAI / LLM Assisted Development

n/a

Important Facts and References

No response

Would you like to implement a fix?

No

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[justinretzolk]

Hey @EugenKon 👋 Thank you for taking the time to raise this! Unfortunately, I'm not quite sure I follow your reproduction notes. Are you saying you already had the aws_s3_bucket_acl resource in the configuration, and you've removed it and added the aws_s3_bucket_public_access_block and aws_s3_bucket_ownership_controls resources, at which point Terraform tries to delete the aws_s3_bucket_acl and create the other two?

[EugenKon]

Yes, in our TF configuration we have ACL and do not have public_access_block, ..._ownership_controls.
To test it quickly and rollback it easily we removed ACL and added public access block, ownership_controls via AWS Console. Because changes had not cause harm we keep them. Then we removed ACL and added public_access_block, ..._ownership_controls into our TF configuration.
Because resources were changed externally, TF should detect that and should not plan to remove ACL, should not plan to create public_access_block, ..._ownership_controls. Instead of that I expect to see:

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply" which
may have affected this plan: