Terraform plan shows no drift when aws_s3_bucket ACL conflicts with aws_s3_bucket_public_access_block

Direct AnswerTerraform shows no drift because aws_s3_bucket_public_access_block does not modify existing bucket ACLs—it only blocks future public access attempts. Both resources match their configured arguments individually, so no drift is surfaced during plan.

Confirmed Facts

AWS evaluates public access block settings after bucket policies and ACLs are applied

Console may display "Public access blocked" while the ACL still grants READ to AllUsers

Terraform state comparison does not detect this effective public access conflict

No provider-level mechanism exists to detect contradictory acl and public_access_block settings during plan

Verification Steps

Check actual ACL: aws s3api get-bucket-acl --bucket bucket-name

Confirm block settings: aws s3api get-public-access-block --bucket bucket-name

Review Terraform state: terraform state show aws_s3_bucket.bucket_name

Check effective access in AWS Console bucket permissions tab

Questions Answered

1. Provider-level detection: No. The AWS provider does not validate effective public access status against configured block settings.

2. Cross-module ordering: Terraform cannot enforce resource ordering across module boundaries. Use depends_on within a single module or consolidate into one module.

3. Roadmap for drift detection: Not currently planned. Effective public access status differs from configured block settings, and Terraform state tracks only the latter.

Recommended Actions

Remove acl="public-read" and use bucket policies for access control, or add explicit validation. AWS Config rules or custom pre-commit checks remain the only reliable detection methods for this configuration conflict.