Error loading state: AccessDenied (S3 backend) Terraform Origin: Platform & cloud OSI layer 7 · Application Last updated 5 Nov 2026

Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403

Terraform can't read/write the S3 bucket (or DynamoDB table) that stores state — IAM permissions or wrong credentials/role.

Exact message you may see Error: Failed to load state: AccessDenied: Access DeniedError refreshing state: AccessDenied: Access Denied status code: 403Error: error loading state: AccessDeniedFailed to save state: failed to upload state: AccessDeniedError: Error acquiring the state lock AccessDeniedException dynamodb
Explore the map of this error Full error map →
Seen on: Terraform AWS

Meaning

The identity needs s3:ListBucket on the bucket and s3:GetObject/PutObject/DeleteObject on the key, plus dynamodb:GetItem/PutItem/DeleteItem for locking, and kms:* if encrypted. Verify the AWS profile/role in use (aws sts get-caller-identity), bucket policy/SCPs, region and the role_arn.

Common causes

  • Missing s3:GetObject/PutObject/ListBucket
  • DynamoDB lock table permissions missing
  • Wrong AWS profile/assumed role
  • Bucket policy/SCP/VPC endpoint denying
  • KMS key policy denying decrypt

⚡ Quick fix

  1. aws sts get-caller-identity to confirm the identity
  2. Grant S3 + DynamoDB (+KMS) permissions on state resources
  3. Set profile/role_arn in the backend block

Detailed fix by platform

AWS

  1. aws s3 ls s3://my-tf-state/path/ && aws sts get-caller-identity

How to diagnose

  1. Identity — Which role?
  2. Policy — S3/DynamoDB/KMS?
  3. Region — Correct?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

Backend configuration changed (migrate or reconfigure) — Terraform: Error: Backend configuration changed — A change in the backend configuration has been detected, which may require migrating existing state (Terraform)Backend configuration…Backend initialization required — Terraform: Error: Backend initialization required, please run "terraform init" — Reason: Initial configuration of the requested backend "s3" (Terraform)Backend initializatio…BucketNotEmpty: bucket you tried to delete is not empty — Terraform: Error: deleting S3 Bucket (my-bucket): BucketNotEmpty: The bucket you tried to delete is not empty (Terraform)BucketNotEmpty: bucke…DynamoDB lock table not found (ResourceNotFoundException) — Terraform: Error: Error acquiring the state lock: ResourceNotFoundException: Requested resource not found / failed to retrieve lock info (Terraform)DynamoDB lock table n…Error acquiring the state lock — Terraform: Error: Error acquiring the state lock — ConditionalCheckFailedException / state blob is already locked (Terraform)Error acquiring the s…IAM AccessDeniedException — AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ... (AWS)IAM AccessDeniedExcep…Invalid AWS Region — Terraform: Error: Invalid AWS Region: us-east-3 / Error: configuring Terraform AWS Provider: validating provider credentials: operation error STS: GetCallerIdentity (Terraform)Invalid AWS RegionNo valid credential sources found (AWS provider) — Terraform: Error: No valid credential sources found — failed to refresh cached credentials, no EC2 IMDS role found / Error: configuring Terraform AWS Provider: no valid credential sources (Terraform)No valid credential s…Error loa…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.