title: Terraform provisioner local-exec - aws cli
body: <p>Trying to use AWS cli to <code>put-public-access-block</code> on an <code>s3</code> bucket but running into an issue and cannot work it out.</p>
  
  <p>This is my code; </p>
  
  <pre><code>resource "aws_s3_bucket" "test" {
    bucket = "blah-blah"
  
    versioning {
      enabled = false
    }
  
    server_side_encryption_configuration {
      rule {
          apply_server_side_encryption_by_default {
              sse_algorithm = "AES256"
          }
      }
    }
  
    tags {
      Name = "blah-blah"
    }
  }
  
  resource "null_resource" "s3publicpol" {
    provisioner "local-exec" {
      command = "aws s3api put-public-access-block --bucket blah-blah --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
    }   
  }
  </code></pre>
  
  <p>When running this from terraform I am getting this message;</p>
  
  <blockquote>
    <p>An error occurred (AccessDenied) when calling the PutPublicAccessBlock operation: Access Denied</p>
  </blockquote>
  
  <p>But when I try and run AWS cli and run the command above myself it works perfectly fine, so I have the permissions within AWS.</p>
  
  <p>Am I missing something I need to do locally for Terraform?</p>
  
  <p>Cheers
  Stephen</p>