### Terraform Version ```shell Terraform v1.10.5 on darwin_arm64 ``` ### Terraform Configuration Files This works: ```terraform backend "s3" { bucket = "redacted" region = "redacted" key = "redacted.tfstate" encrypt = true assume_role = { role_arn = "arn:aws:iam::1234567890:role/redacted" } } ``` This fails: ```terraform backend "s3" { bucket = "redacted" region = "redacted" key = "redacted.tfstate" encrypt = true assume_role = { role_arn = "arn:aws:iam::0987654321:role/redacted" } assume_role = { role_arn = "arn:aws:iam::1234567890:role/redacted" } } ``` ### Debug Output The first example initialises fine, the second fails with: ``` │ Error: Error loading state: │ Unable to access object "redacted.tfstate" in S3 bucket "redacted": operation error S3: HeadObject, https response error StatusCode: 403, RequestID: redacted, HostID: redacted, api error Forbidden: Forbidden │ │ Terraform failed to load the default state from the "s3" backend. │ State migration cannot occur unless the state can be loaded. Backend │ modification and state migration has been aborted. The state in both the │ source and the destination remain unmodified. Please resolve the │ above error and try again. ``` ### Expected Behavior The request should work with chained role assumptions. ### Actual Behavior It fails with a role inbetween. ### Steps to Reproduce 1. `terraform init` ### Additional Context I have manually verified that 1. The role has access (by assuming it directly) 2. The chain is intact (assuming works on the CLI and the final role has access to S3 if role-chained) I am also suspect that the roles are actually chained. The following configuration: ```terraform backend "s3" { bucket = "redacted" region = "redacted" key = "redacted.tfstate" encrypt = true assume_role = { role_arn = "arn:aws:iam::0987654321:role/redacted" } assume_role = { role_arn = "gibberish_arn" } } ``` Still yields the "403" error, instead of a "invalid ARN" error, as I would have expected. The documentation is a bit iffy as well. It just says "multiple values can be specified", but isn't clear about whether that means 1. passing an array of objects 2. passing multiple role_arn properties in the object 3. passing multiple blocks, like in the provider config. I tried all of these and more, but looking at the source code I believe my above code is what would be intended. ### References - #36506 ### Generative AI / LLM assisted development? _No response_