# Import s3 bucket from different account

**URL:** <https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129>\
**Category:** Terraform\
**Created:** [December 13, 2021, 6:40pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129 "2021-12-13T18:40:41Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evangertis/32/14050_2.png) [@EvanGertis](https://discuss.hashicorp.com/u/EvanGertis)\
**Post date:** [December 13, 2021, 6:40pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/1 "2021-12-13T18:40:42Z")

</div>

I would like to import and s3 bucket from a different aws account. Currently, I’ve configured all of our AWS accounts with infrastructure that adheres to the CIS foundations benchmark. One of the resources

```auto
resource "aws_cloudtrail" "nfcisbenchmark" {
  count = var.environment == "billing" ? 1 : 0 
  name = "${var.name}"
  s3_bucket_name = "nf-cisbenchmark-nf-logging-cloudtrail"
  enable_logging = true
  # 3.2 Ensure CloudTrail log file validation is enabled (Automated)
  enable_log_file_validation = true
  # 3.1 Ensure CloudTrail is enabled in all regions (Automated)
  is_multi_region_trail = true
  # CIS Benchmark 3.1 Ensure CloudTrail is enabled in all regions
  # ensuring that a multi-regions trail exists will ensure that Global Service Logging
  # is enabled for a trail by default to capture recording of events generated on AWS
  # global services
  include_global_service_events = true
  is_organization_trail = "${var.environment == "billing"? true : false}"
  # 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)
  kms_key_id = aws_kms_key.nfcisbenchmark.arn
  depends_on = [aws_s3_bucket.nfcisbenchmark_cloudtrail]
  cloud_watch_logs_role_arn = aws_iam_role.cloudwatch.arn
  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.nfcisbenchmark.arn}:*"

  event_selector {
    # 3.11 Ensure that Object-level logging for read events is enabled for S3 bucket (Automated)
    read_write_type = "All"
    include_management_events = true
  }

  // Tags
  tags = {
    Name = "${var.name}-cloudtrail"
    cost_environment = "${local.cost_environment}"
    cost_category = "SEC"
    cost_team_owner = "MOPRAV"
  }
}

```

references and aws\_s3\_bucket resource from a different aws account. Ideally, I’d like to import this resources so that it can be used like so

```auto
resource "aws_cloudtrail" "nfcisbenchmark" {
  count = var.environment == "billing" ? 1 : 0 
  name = "${var.name}"
  s3_bucket_name = "nf-cisbenchmark-nf-logging-cloudtrail"
  enable_logging = true
  # 3.2 Ensure CloudTrail log file validation is enabled (Automated)
  enable_log_file_validation = true
  # 3.1 Ensure CloudTrail is enabled in all regions (Automated)
  is_multi_region_trail = true
  # CIS Benchmark 3.1 Ensure CloudTrail is enabled in all regions
  # ensuring that a multi-regions trail exists will ensure that Global Service Logging
  # is enabled for a trail by default to capture recording of events generated on AWS
  # global services
  include_global_service_events = true
  is_organization_trail = "${var.environment == "billing"? true : false}"
  # 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)
  kms_key_id = aws_kms_key.nfcisbenchmark.arn
  depends_on = [data.aws_s3_bucket.nfcisbenchmark_cloudtrail]
  cloud_watch_logs_role_arn = aws_iam_role.cloudwatch.arn
  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.nfcisbenchmark.arn}:*"

  event_selector {
    # 3.11 Ensure that Object-level logging for read events is enabled for S3 bucket (Automated)
    read_write_type = "All"
    include_management_events = true
  }

  // Tags
  tags = {
    Name = "${var.name}-cloudtrail"
    cost_environment = "${local.cost_environment}"
    cost_category = "SEC"
    cost_team_owner = "MOPRAV"
  }
}

```

The specific line is `data.aws_s3_bucket.nfcisbenchmark_cloudtrail`. Any help with this would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evangertis/32/14050_2.png) [@EvanGertis](https://discuss.hashicorp.com/u/EvanGertis)\
**Post date:** [December 14, 2021, 1:28pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/2 "2021-12-14T13:28:48Z")

</div>

I ended up just dropping the resource, but I would like to know if anyone knows how to do this.

---

<div class="post-metadata">

**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\
**Post date:** [December 14, 2021, 1:53pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/3 "2021-12-14T13:53:27Z")

</div>

I’m not quite sure what you are wanting. Are you talking about the reference to a S3 bucket resource in the depends\_on?

---

<div class="post-metadata">

**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evangertis/32/14050_2.png) [@EvanGertis](https://discuss.hashicorp.com/u/EvanGertis)\
**Post date:** [December 14, 2021, 2:39pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/4 "2021-12-14T14:39:59Z")

</div>

`[aws_s3_bucket.nfcisbenchmark_cloudtrail]`

---

<div class="post-metadata">

**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\
**Post date:** [December 14, 2021, 3:08pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/5 "2021-12-14T15:08:02Z")

</div>

That’s in the `depends_on` yes?

---

<div class="post-metadata">

**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evangertis/32/14050_2.png) [@EvanGertis](https://discuss.hashicorp.com/u/EvanGertis)\
**Post date:** [December 14, 2021, 3:10pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/6 "2021-12-14T15:10:16Z")

</div>

Yes, that is correct.

---

<div class="post-metadata">

**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\
**Post date:** [December 14, 2021, 3:13pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/7 "2021-12-14T15:13:19Z")

</div>

`depends_on` is used to give Terraform extra information about the dependency graph. In general it isn’t needed (and using it when not needed can actually cause issues). So unless there is a specific need you usually wouln’t use it at all.

What are you hoping using it here would do?

---

<div class="post-metadata">

**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evangertis/32/14050_2.png) [@EvanGertis](https://discuss.hashicorp.com/u/EvanGertis)\
**Post date:** [December 14, 2021, 6:30pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/8 "2021-12-14T18:30:24Z")

</div>

The point is to replace the variable referenced in the code.

---

<div class="post-metadata">

**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\
**Post date:** [December 14, 2021, 9:00pm UTC](https://discuss.hashicorp.com/t/import-s3-bucket-from-different-account/33129/9 "2021-12-14T21:00:39Z")

</div>

I mean why is the `depends_on` there at all?