Dynamic LifeCycle Transitions

Apinkerton

May 21, 2023, 7:33 PM PDT

Both
terraform init
and
terraform apply

…work as expected, but I don’t see the dynamic transitions being pulled in to the plan/apply.
I’m using a custom s3 module that has this in variables.tf

variable "transitions_list" {
  type = list(object({
    t_storage_class = string,
    t_days          = number
  }))
  default     = []
  description = "A list of transition classes and days for each transition"
}

And in main.tf I have:

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    id     = "transition_to_sc"
    status = var.transition_to_sc_enabled
    transition {
      days          = var.transition_to_sc_days
      storage_class = var.transition_to_sc
    }

    dynamic "transition" {
      for_each = var.transitions_list
        content {
          storage_class = transition.value["t_storage_class"]
          days          = transition.value["t_days"]
      }
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
  depends_on = [
    aws_s3_bucket.this,
  ]
}

In a different AWS account I source the above with an s3.tf file that looks like:

locals {
  # Configure buckets here.
  buckets = {
    "drew-test-no-transitions7" = {
      billing = "test-lab"
      center  = "test"
      lab     = "test-lab"
    },
    "drew-test-one-transitions7" = {
      billing = "test-lab"
      center  = "test"
      lab     = "test-lab"

      transitions_l = [
        {
          t_storage_class = "GLACIER",
          t_days = 30
        }
      ]
    },
    "drew-test-multiple-transitions7" = {
      billing = "test-lab"
      center  = "test"
      lab     = "test-lab"

      transitions_l = [
        {
          t_storage_class = "GLACIER",
          t_days = 30
        },
        {
          t_storage_class = "DEEP_ARCHIVE",
          t_days = 180
        }
      ]
    }

  } # End buckets
}

And an s3-infra.tf file that looks largely like this:

module "drew-lab-buckets" {
source      = "../../s3-bucket/modules/s3_bucket/"
  for_each    = local.buckets
  bucket_name = each.key

  # NOTES:
  # We can't use list(map(any)) since we have both a string and a number
  # We need a try clause so we don't mess up existing buckets or buckets that don't have extra transtions
  # 

  transitions_list = try(
    [
      for tran in [ each.key.transitions_l[*] ] :
        {
          storage_class = tran[*].t_storage_class,
          days = tran[*].t_days
        }
    ], []
  )

  tags = {
    Billing = each.value.billing
    Center  = each.value.center
    Lab     = each.value.lab
  }
}

Both
$ terraform init
and
$ terraform apply

Work as expected, but I don’t see the dynamic transitions being pulled in to the plan/apply.
I’m using a custom s3 module that has this in variables.tf

variable "transitions_list" {
  type = list(object({
    t_storage_class = string,
    t_days          = number
  }))
  default     = []
  description = "A list of transition classes and days for each transition"
}

And in main.tf I have:

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    id     = "transition_to_sc"
    status = var.transition_to_sc_enabled
    transition {
      days          = var.transition_to_sc_days
      storage_class = var.transition_to_sc
    }

    dynamic "transition" {
      for_each = var.transitions_list
        content {
          storage_class = transition.value["t_storage_class"]
          days          = transition.value["t_days"]
      }
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
  depends_on = [
    aws_s3_bucket.this,
  ]
}

In a different AWS account source the above with an s3.tf file that looks like:

locals {
  # Configure buckets here.
  buckets = {
    "drew-test-no-transitions7" = {
      billing = "test-lab"
      center  = "test"
      lab     = "test-lab"
    },
    "drew-test-one-transitions7" = {
      billing = "test-lab"
      center  = "test"
      lab     = "test-lab"

      transitions_l = [
        {
          t_storage_class = "GLACIER",
          t_days = 30
        }
      ]
    },
    "drew-test-multiple-transitions7" = {
      billing = "test-lab"
      center  = "test"
      lab     = "test-lab"

      transitions_l = [
        {
          t_storage_class = "GLACIER",
          t_days = 30
        },
        {
          t_storage_class = "DEEP_ARCHIVE",
          t_days = 180
        }
      ]
    }

  } # End buckets
}

And an s3-infra.tf file that looks largely like this:

module "drew-lab-buckets" {
source      = "../../s3-bucket/modules/s3_bucket/"
  for_each    = local.buckets
  bucket_name = each.key

  # NOTES:
  # We can't use list(map(any)) since we have both a string and a number
  # We need a try clause so we don't mess up existing buckets or buckets that don't have extra transtions
  # 

  transitions_list = try(
    [
      for tran in [ each.key.transitions_l[*] ] :
        {
          storage_class = tran[*].t_storage_class,
          days = tran[*].t_days
        }
    ], []
  )

  tags = {
    Billing = each.value.billing
    Center  = each.value.center
    Lab     = each.value.lab
  }
}

I must be using the Splat expression notation incorrectly such that transitions_l is not taken into account when running plan and apply. Below is the truncated apply.

$ tf apply --auto-approve -lock=false
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.require_ssl: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.read_write: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.read_write: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket.this: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.require_ssl: Read complete after 0s [id=551231130]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket.this: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket.this: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.read_only: Reading...
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.read_write: Reading...
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.require_ssl: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.read_only: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.require_ssl: Reading...
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.read_only: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.read_only: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.read_only: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.read_only: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.read_write: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.read_write: Reading...
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.require_ssl: Read complete after 0s [id=919925104]
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.require_ssl: Read complete after 0s [id=350759471]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.quilt_policy: Reading...
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.quilt_policy: Reading...
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.read_write: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.quilt_policy: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.users: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.quilt_policy: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.quilt_policy: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.users: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.quilt_policy: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.users: Reading...
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.users: Reading...
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.users: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.users: Read complete after 0s [id=1132004489]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_public_access_block.example[0]: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_server_side_encryption_configuration.this: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_public_access_block.example[0]: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_public_access_block.example[0]: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_versioning.this: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_lifecycle_configuration.this: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_versioning.this: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_versioning.this: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_ownership_controls.this: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_ownership_controls.this: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_ownership_controls.this: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_request_payment_configuration.this: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_request_payment_configuration.this: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_request_payment_configuration.this: Refreshing state... [id=drew-test-one-transitions7]
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.this: Reading...
module.drew-lab-buckets["drew-test-one-transitions8"].data.aws_iam_policy_document.this: Read complete after 0s [id=1629160881]
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.this: Reading...
module.drew-lab-buckets["drew-test-multiple-transitions8"].data.aws_iam_policy_document.this: Read complete after 0s [id=4864871]
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.this: Reading...
module.drew-lab-buckets["drew-test-no-transitions8"].data.aws_iam_policy_document.this: Read complete after 0s [id=1936525441]
module.drew-lab-buckets["drew-test-multiple-transitions7"].aws_s3_bucket_policy.this[0]: Refreshing state... [id=drew-test-multiple-transitions7]
module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_policy.this[0]: Refreshing state... [id=drew-test-no-transitions7]
module.drew-lab-buckets["drew-test-one-transitions7"].aws_s3_bucket_policy.this[0]: Refreshing state... [id=drew-test-one-transitions7]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
  - destroy
 <= read (data resources)

Terraform will perform the following actions:

  
 
  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket.this will be created
  + resource "aws_s3_bucket" "this" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "drew-test-multiple-transitions8"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "Billing" = "test-lab"
          + "Center"  = "test"
          + "Lab"     = "test-lab"
        }
      + tags_all                    = {
          + "Billing" = "test-lab"
          + "Center"  = "test"
          + "Lab"     = "test-lab"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule {
          + allowed_headers = (known after apply)
          + allowed_methods = (known after apply)
          + allowed_origins = (known after apply)
          + expose_headers  = (known after apply)
          + max_age_seconds = (known after apply)
        }

      + grant {
          + id          = (known after apply)
          + permissions = (known after apply)
          + type        = (known after apply)
          + uri         = (known after apply)
        }

      + lifecycle_rule {
          + abort_incomplete_multipart_upload_days = (known after apply)
          + enabled                                = (known after apply)
          + id                                     = (known after apply)
          + prefix                                 = (known after apply)
          + tags                                   = (known after apply)

          + expiration {
              + date                         = (known after apply)
              + days                         = (known after apply)
              + expired_object_delete_marker = (known after apply)
            }

          + noncurrent_version_expiration {
              + days = (known after apply)
            }

          + noncurrent_version_transition {
              + days          = (known after apply)
              + storage_class = (known after apply)
            }

          + transition {
              + date          = (known after apply)
              + days          = (known after apply)
              + storage_class = (known after apply)
            }
        }

      + logging {
          + target_bucket = (known after apply)
          + target_prefix = (known after apply)
        }

      + object_lock_configuration {
          + object_lock_enabled = (known after apply)

          + rule {
              + default_retention {
                  + days  = (known after apply)
                  + mode  = (known after apply)
                  + years = (known after apply)
                }
            }
        }

      + replication_configuration {
          + role = (known after apply)

          + rules {
              + delete_marker_replication_status = (known after apply)
              + id                               = (known after apply)
              + prefix                           = (known after apply)
              + priority                         = (known after apply)
              + status                           = (known after apply)

              + destination {
                  + account_id         = (known after apply)
                  + bucket             = (known after apply)
                  + replica_kms_key_id = (known after apply)
                  + storage_class      = (known after apply)

                  + access_control_translation {
                      + owner = (known after apply)
                    }

                  + metrics {
                      + minutes = (known after apply)
                      + status  = (known after apply)
                    }

                  + replication_time {
                      + minutes = (known after apply)
                      + status  = (known after apply)
                    }
                }

              + filter {
                  + prefix = (known after apply)
                  + tags   = (known after apply)
                }

              + source_selection_criteria {
                  + sse_kms_encrypted_objects {
                      + enabled = (known after apply)
                    }
                }
            }
        }

      + server_side_encryption_configuration {
          + rule {
              + bucket_key_enabled = (known after apply)

              + apply_server_side_encryption_by_default {
                  + kms_master_key_id = (known after apply)
                  + sse_algorithm     = (known after apply)
                }
            }
        }

      + versioning {
          + enabled    = (known after apply)
          + mfa_delete = (known after apply)
        }

      + website {
          + error_document           = (known after apply)
          + index_document           = (known after apply)
          + redirect_all_requests_to = (known after apply)
          + routing_rules            = (known after apply)
        }
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_lifecycle_configuration.this will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "this" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + id     = "transition_to_sc"
          + status = "Enabled"

          + abort_incomplete_multipart_upload {
              + days_after_initiation = 7
            }

          + transition {
              + days          = 1
              + storage_class = "INTELLIGENT_TIERING"
            }
        }
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_ownership_controls.this will be created
  + resource "aws_s3_bucket_ownership_controls" "this" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + object_ownership = "BucketOwnerPreferred"
        }
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_policy.this[0] will be created
  + resource "aws_s3_bucket_policy" "this" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "s3:*"
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = [
                                  + "false",
                                ]
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = "*"
                      + Resource  = [
                          + "arn:aws:s3:::drew-test-multiple-transitions8/*",
                          + "arn:aws:s3:::drew-test-multiple-transitions8",
                        ]
                      + Sid       = "require_ssl"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_public_access_block.example[0] will be created
  + resource "aws_s3_bucket_public_access_block" "example" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_request_payment_configuration.this will be created
  + resource "aws_s3_bucket_request_payment_configuration" "this" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + payer  = "BucketOwner"
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_server_side_encryption_configuration.this will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # module.drew-lab-buckets["drew-test-multiple-transitions8"].aws_s3_bucket_versioning.this will be created
  + resource "aws_s3_bucket_versioning" "this" {
      + bucket = (known after apply)
      + id     = (known after apply)

      + versioning_configuration {
          + mfa_delete = "Disabled"
          + status     = "Enabled"
        }
    }

  # module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket.this will be destroyed
  # (because module.drew-lab-buckets["drew-test-no-transitions7"] is not in configuration)
  - resource "aws_s3_bucket" "this" {
      - arn                         = "arn:aws:s3:::drew-test-no-transitions7" -> null
      - bucket                      = "drew-test-no-transitions7" -> null
      - bucket_domain_name          = "drew-test-no-transitions7.s3.amazonaws.com" -> null
      - bucket_regional_domain_name = "drew-test-no-transitions7.s3.us-east-2.amazonaws.com" -> null
      - force_destroy               = false -> null
      - hosted_zone_id              = "Z2O1EMRO9K5GLX" -> null
      - id                          = "drew-test-no-transitions7" -> null
      - object_lock_enabled         = false -> null
      - policy                      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:*"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Deny"
                      - Principal = "*"
                      - Resource  = [
                          - "arn:aws:s3:::drew-test-no-transitions7/*",
                          - "arn:aws:s3:::drew-test-no-transitions7",
                        ]
                      - Sid       = "require_ssl"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - region                      = "us-east-2" -> null
      - request_payer               = "BucketOwner" -> null
      - tags                        = {
          - "Billing" = "test-lab"
          - "Center"  = "test"
          - "Lab"     = "test-lab"
        } -> null
      - tags_all                    = {
          - "Billing" = "test-lab"
          - "Center"  = "test"
          - "Lab"     = "test-lab"
        } -> null

      - grant {
          - id          = "703047bbc7f9b772bfdd57dceeb368ac490978b9375a7176e107adc102c67d04" -> null
          - permissions = [
              - "FULL_CONTROL",
            ] -> null
          - type        = "CanonicalUser" -> null
        }

      - lifecycle_rule {
          - abort_incomplete_multipart_upload_days = 7 -> null
          - enabled                                = true -> null
          - id                                     = "transition_to_sc" -> null
          - tags                                   = {} -> null

          - transition {
              - days          = 1 -> null
              - storage_class = "INTELLIGENT_TIERING" -> null
            }
        }

      - server_side_encryption_configuration {
          - rule {
              - bucket_key_enabled = false -> null

              - apply_server_side_encryption_by_default {
                  - sse_algorithm = "AES256" -> null
                }
            }
        }

      - versioning {
          - enabled    = true -> null
          - mfa_delete = false -> null
        }
    }

  # module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_lifecycle_configuration.this will be destroyed
  # (because module.drew-lab-buckets["drew-test-no-transitions7"] is not in configuration)
  - resource "aws_s3_bucket_lifecycle_configuration" "this" {
      - bucket = "drew-test-no-transitions7" -> null
      - id     = "drew-test-no-transitions7" -> null

      - rule {
          - id     = "transition_to_sc" -> null
          - status = "Enabled" -> null

          - abort_incomplete_multipart_upload {
              - days_after_initiation = 7 -> null
            }

          - filter {
            }

          - transition {
              - days          = 1 -> null
              - storage_class = "INTELLIGENT_TIERING" -> null
            }
        }
    }

  # module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_ownership_controls.this will be destroyed
  # (because module.drew-lab-buckets["drew-test-no-transitions7"] is not in configuration)
  - resource "aws_s3_bucket_ownership_controls" "this" {
      - bucket = "drew-test-no-transitions7" -> null
      - id     = "drew-test-no-transitions7" -> null

      - rule {
          - object_ownership = "BucketOwnerPreferred" -> null
        }
    }

  # module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_policy.this[0] will be destroyed
  # (because module.drew-lab-buckets["drew-test-no-transitions7"] is not in configuration)
  - resource "aws_s3_bucket_policy" "this" {
      - bucket = "drew-test-no-transitions7" -> null
      - id     = "drew-test-no-transitions7" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:*"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = [
                                  - "false",
                                ]
                            }
                        }
                      - Effect    = "Deny"
                      - Principal = "*"
                      - Resource  = [
                          - "arn:aws:s3:::drew-test-no-transitions7/*",
                          - "arn:aws:s3:::drew-test-no-transitions7",
                        ]
                      - Sid       = "require_ssl"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_public_access_block.example[0] will be destroyed
  # (because module.drew-lab-buckets["drew-test-no-transitions7"] is not in configuration)
  - resource "aws_s3_bucket_public_access_block" "example" {
      - block_public_acls       = true -> null
      - block_public_policy     = true -> null
      - bucket                  = "drew-test-no-transitions7" -> null
      - id                      = "drew-test-no-transitions7" -> null
      - ignore_public_acls      = true -> null
      - restrict_public_buckets = true -> null
    }

  # module.drew-lab-buckets["drew-test-no-transitions7"].aws_s3_bucket_request_payment_configuration.this will be destroyed
  # (because module.drew-lab-buckets["drew-test-no-transitions7"] is not in configuration)
  - resource "aws_s3_bucket_request_payment_configuration" "this" {
      - bucket = "drew-test-no-transitions7" -> null
      - id 

Apologies for bad formatting.

Any help appreciated!!

Duplicate of Referencing a list of object in sub-module ?

@maxb yes, this is a dupe. Sorry for the noise. It was hung up in some other queue for weeks.

Ahh, sorry… I found this message in the spam review queue and noticed it wasn’t spam and so I approved it, but I didn’t notice there was another topic with similar content since the title of the other topic was different.

I’ll re-close this topic to emphasize the other one.