<p>Try this, since the bucket is already there with the policy you can run the below command to get the policy inside the tf state</p>
<pre><code>$ terraform import aws_s3_bucket_policy.allow_access_from_another_account my-s3-bucket-name
</code></pre>
<p>Once the policy is there in the TF, run the below code in <code>main.tf</code></p>
<p>So that it will match with the policy in the state and in the plan it will display if it matches with the state or not.</p>
<blockquote>
<p>//resource &quot;aws_s3_bucket&quot; &quot;example&quot; {
//  bucket = &quot;my-tf-test-bucket&quot;
//}</p>
<pre><code>    resource &quot;aws_s3_bucket_policy&quot; &quot;allow_access_from_another_account&quot; {
      bucket = &quot;enter the bucket ID from the portal&quot;
      policy = data.aws_iam_policy_document.allow_access_from_another_account.json
    }
    
    data &quot;aws_iam_policy_document&quot; &quot;allow_access_from_another_account&quot; {
      statement {
        principals {
          type        = &quot;AWS&quot;
          identifiers = [&quot;123456789012&quot;]
        }
    
        actions = [
          &quot;s3:GetObject&quot;,
          &quot;s3:ListBucket&quot;,
        ]
    
        resources = [
          &quot;arn for aws bucket&quot;,
        ]
      }
    }
</code></pre>
</blockquote>

CC BY-SA 4.0
2022-08-24T22:26:20.033Z
Thanks accepting as this is the right TF answer.  Also though, I found this CLI command is an easy way there from CI (not as good, but quick to implement).  `aws s3api put-bucket-policy --bucket <bucket> --policy file://<local-file>.json`
John Humphreys
CC BY-SA 4.0
2022-08-24T18:54:04.807Z
2022-08-24T18:54:04.807Z
SandeshR
<p>I have a large bucket policy historically maintained by hand.</p>
<p>I'd like to move it into CI/terraform (for the policy maintenance), but I don't want TF to own the bucket itself.</p>
<p>Is there any way to have TF &quot;import&quot; the huge existing policy and generate the TF file for it?  <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy" rel="nofollow noreferrer">https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy</a></p>

<terraform><s3>
Convert an existing s3 bucket policy into a terraform-managed policy?
John Humphreys
# Convert an existing s3 bucket policy into a terraform-managed policy?

(Asked by: username_0 on 2022-08-24)

I have a large bucket policy historically maintained by hand.

I'd like to move it into CI/terraform (for the policy maintenance), but I don't want TF to own the bucket itself.

Is there any way to have TF "import" the huge existing policy and generate the TF file for it? <https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy>

**Tags:** terraform, s3


---

## 1 answers

### Answer by username_1 on 2022-08-24. Score: 1 | Accepted answer

Try this, since the bucket is already there with the policy you can run the below command to get the policy inside the tf state
$ terraform import aws_s3_bucket_policy.allow_access_from_another_account my-s3-bucket-name

Once the policy is there in the TF, run the below code in main.tf
So that it will match with the policy in the state and in the plan it will display if it matches with the state or not.

//resource "aws_s3_bucket" "example" {
//  bucket = "my-tf-test-bucket"
//}
    resource "aws_s3_bucket_policy" "allow_access_from_another_account" {
      bucket = "enter the bucket ID from the portal"
      policy = data.aws_iam_policy_document.allow_access_from_another_account.json
    }
    
    data "aws_iam_policy_document" "allow_access_from_another_account" {
      statement {
        principals {
          type        = "AWS"
          identifiers = ["123456789012"]
        }
    
        actions = [
          "s3:GetObject",
          "s3:ListBucket",
        ]
    
        resources = [
          "arn for aws bucket",
        ]
      }
    }

> **Comments:**
> **username_0**: Thanks accepting as this is the right TF answer.  Also though, I found this CLI command is an easy way there from CI (not as good, but quick to implement).  `aws s3api put-bucket-policy --bucket <bucket> --policy file://<local-file>.json`  

---

