How to Import an AWS S3 Bucket Public Access Block into Terraform

Import AWS S3 Bucket Public Access Block with Terraback (recommended)

Terraback reverse-engineers your live infrastructure: it reads the Amazon S3 resource with read-only credentials, generates the HCL, and produces the exact import block. Two commands take you from a live AWS S3 Bucket Public Access Block to managed Terraform.

terraback scan all aws --region us-east-1

terraback aws import --method bulk

The Terraform import block

Terraback emits a Terraform 1.5+ import block like the one below. Because the block lives in your configuration, the import is reviewable in a pull request and repeatable across environments.

import {
  to = aws_s3_bucket_public_access_block.assets
  id = "my-app-assets"
}

Example aws_s3_bucket_public_access_block configuration

Here is a realistic AWS S3 Bucket Public Access Block block. Terraback generates a fuller version from your actual resource attributes; this is a minimal, valid starting point.

resource "aws_s3_bucket_public_access_block" "assets" {
  bucket = "my-app-assets"

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Gotchas when importing a AWS S3 Bucket Public Access Block

• Import by the bucket name; the public access block is a separate resource from aws_s3_bucket.
• All four flags default to true for new buckets; AWS now blocks public access by default, so an imported bucket usually has them all enabled.
• If you intend the bucket to serve public content, you must set block_public_policy and restrict_public_buckets to false here and grant access via the bucket policy.
• Removing this resource does not re-open the bucket automatically; the last-applied settings persist until something changes them.

Doing it manually with terraform import

The native approach is to write the aws_s3_bucket_public_access_block block by hand, then run terraform import aws_s3_bucket_public_access_block.example <import-id> for every resource, one at a time. That works for a handful of resources, but it does not scale: you author all the HCL yourself and repeat the command for each item. Terraback generates the HCL and the import blocks for your whole account in one pass.

Import other AWS resources