Answers: <p>Try this, since the bucket is already there with the policy you can run the below command to get the policy inside the tf state</p>
  <pre><code>$ terraform import aws_s3_bucket_policy.allow_access_from_another_account my-s3-bucket-name
  </code></pre>
  <p>Once the policy is there in the TF, run the below code in <code>main.tf</code></p>
  <p>So that it will match with the policy in the state and in the plan it will display if it matches with the state or not.</p>
  <blockquote>
  <p>//resource &quot;aws_s3_bucket&quot; &quot;example&quot; {
  //  bucket = &quot;my-tf-test-bucket&quot;
  //}</p>
  <pre><code>    resource &quot;aws_s3_bucket_policy&quot; &quot;allow_access_from_another_account&quot; {
        bucket = &quot;enter the bucket ID from the portal&quot;
        policy = data.aws_iam_policy_document.allow_access_from_another_account.json
      }
      
      data &quot;aws_iam_policy_document&quot; &quot;allow_access_from_another_account&quot; {
        statement {
          principals {
            type        = &quot;AWS&quot;
            identifiers = [&quot;123456789012&quot;]
          }
      
          actions = [
            &quot;s3:GetObject&quot;,
            &quot;s3:ListBucket&quot;,
          ]
      
          resources = [
            &quot;arn for aws bucket&quot;,
          ]
        }
      }
  </code></pre>
  </blockquote>
  
Answers: CC BY-SA 4.0
Answers: 2022-08-24T22:26:20.033Z
Answers: Thanks accepting as this is the right TF answer.  Also though, I found this CLI command is an easy way there from CI (not as good, but quick to implement).  `aws s3api put-bucket-policy --bucket <bucket> --policy file://<local-file>.json`
Answers: John Humphreys
Answers: CC BY-SA 4.0
Answers: 2022-08-24T18:54:04.807Z
Answers: 2022-08-24T18:54:04.807Z
Answers: SandeshR
Body: <p>I have a large bucket policy historically maintained by hand.</p>
  <p>I'd like to move it into CI/terraform (for the policy maintenance), but I don't want TF to own the bucket itself.</p>
  <p>Is there any way to have TF &quot;import&quot; the huge existing policy and generate the TF file for it?  <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy" rel="nofollow noreferrer">https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy</a></p>
  
Tags: <terraform><s3>
Title: Convert an existing s3 bucket policy into a terraform-managed policy?
UserDisplayName: John Humphreys
ThreadText: # Convert an existing s3 bucket policy into a terraform-managed policy?
  
  (Asked by: username_0 on 2022-08-24)
  
  I have a large bucket policy historically maintained by hand.
  
  I'd like to move it into CI/terraform (for the policy maintenance), but I don't want TF to own the bucket itself.
  
  Is there any way to have TF "import" the huge existing policy and generate the TF file for it? <https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy>
  
  **Tags:** terraform, s3
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-08-24. Score: 1 | Accepted answer
  
  Try this, since the bucket is already there with the policy you can run the below command to get the policy inside the tf state
  
  ```
  $ terraform import aws_s3_bucket_policy.allow_access_from_another_account my-s3-bucket-name
  
  ```
  
  Once the policy is there in the TF, run the below code in `main.tf`
  
  So that it will match with the policy in the state and in the plan it will display if it matches with the state or not.
  
  > //resource "aws\_s3\_bucket" "example" {
  > // bucket = "my-tf-test-bucket"
  > //}
  >
  > ```
  >     resource "aws_s3_bucket_policy" "allow_access_from_another_account" {
  >       bucket = "enter the bucket ID from the portal"
  >       policy = data.aws_iam_policy_document.allow_access_from_another_account.json
  >     }
  >     
  >     data "aws_iam_policy_document" "allow_access_from_another_account" {
  >       statement {
  >         principals {
  >           type        = "AWS"
  >           identifiers = ["123456789012"]
  >         }
  >     
  >         actions = [
  >           "s3:GetObject",
  >           "s3:ListBucket",
  >         ]
  >     
  >         resources = [
  >           "arn for aws bucket",
  >         ]
  >       }
  >     }
  >
  > ```
  
  > **Comments:**
  > **username_0**: Thanks accepting as this is the right TF answer.  Also though, I found this CLI command is an easy way there from CI (not as good, but quick to implement).  `aws s3api put-bucket-policy --bucket <bucket> --policy file://<local-file>.json`  
  
  ---
  
  