Skip to content

Fix: s3 terraform state bucket naming#74

Draft
cstirry wants to merge 2 commits into
thealphacubicle:developfrom
govex:bugfix/s3-terraform-state-bucket-naming
Draft

Fix: s3 terraform state bucket naming#74
cstirry wants to merge 2 commits into
thealphacubicle:developfrom
govex:bugfix/s3-terraform-state-bucket-naming

Conversation

@cstirry
Copy link
Copy Markdown

@cstirry cstirry commented May 13, 2026

Problem

When a new deployer runs uv run opencontext authenticate, all checks pass cleanly — Python, uv, AWS CLI, credentials, and Terraform. But then when they run uv run opencontext configure and complete the CLI wizard, it fails at the end with no useful explanation:

Error: An error occurred (403) when calling the HeadBucket operation: Forbidden

The root cause is that the S3 bucket name for Terraform state was hardcoded to opencontext-terraform-state. S3 bucket names are globally/regionally? unique across all AWS accounts — this name is already owned by another account, so any new deployer hits a 403 with no actionable error message.


How to reproduce the original bug

  1. Clone the repo fresh
  2. Run uv run opencontext authenticate — all checks pass
  3. Run uv run opencontext configure and complete the wizard
  4. At the end, after answering all questions, the process fails with:
Error: An error occurred (403) when calling the HeadBucket operation: Forbidden

Potential Fix

1. Interactive bucket name prompt with immediate validation

Instead of silently using a hardcoded bucket name, the wizard now prompts the user during the AWS Settings step. The default suggestion is opencontext-terraform-state but the user can change it. The bucket is validated immediately — if it's owned by another account, the user is told right away and re-prompted before continuing.

2. Always run terraform init -reconfigure

The original code skipped terraform init if a .terraform directory already existed. This caused a failure on re-runs when the bucket name changed — Terraform detected a backend config change and refused to proceed. Replacing the existence check with -reconfigure ensures the backend config is always in sync.

3. New _check_state_bucket() helper

Extracted bucket validation into a clean helper that returns "ok", "missing", or "taken" without crashing Rich's markup renderer with raw AWS error text.


Files changed

  • cli/commands/configure.py — all logic changes
  • tests/test_cli_configure.py — updated wizard responses and assertions
  • tests/test_cli_configure_extended.py — added boto3.client mock and bucket prompt response to all wizard tests

Note on Terraform files

terraform/bootstrap/variables.tf and terraform/aws/main.tf still contain
the hardcoded default opencontext-terraform-state. These are not changed in
this PR because configure.py passes the bucket name to Terraform at init time
via -backend-config=bucket=<name>, which overrides the hardcoded default at
runtime.

However, anyone running terraform init directly (bypassing the CLI) would
still hit the same naming collision. May want to consider updating those files
to remove the hardcoded default if that could be an issue.


Screenshot Before

Screenshot 2026-05-11 at 9 54 52 AM

Screenshot After

Screenshot 2026-05-11 at 9 54 29 AM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant