s3:DeleteObject IAM permission on S3 backend

[ericrichtert]

Terraform Version

Terraform 1.10.1

Affected Pages

https://developer.hashicorp.com/terraform/language/backend/s3#:~:text=Note%3A%20s3%3ADeleteObject%20is%20not%20needed%2C%20as%20Terraform%20will%20not%20delete%20the%20state%20storage.

What is the docs issue?

The s3:DeleteObject is needed when using the 'use_lockfile=true'. From the s3 accesslogs:

request_uri: "DELETE /terraform.tfstate.tflock?x-id=DeleteObject HTTP/1.1"

Proposal

No response

References

#35661

[bschaatsbergen]

Hi @ericrichtert,

Thank you for reporting this! The S3 backend is managed by the AWS Provider team at HashiCorp, and we’ve added this issue to their triage queue.

You are correct—when use_lockfile=true is set, the s3:DeleteObject permission is required for Terraform to delete the lock file (.tflock). We’ll update the documentation to clarify that the s3:DeleteObject permission is required in this case. Thanks again for bringing this to our attention!