Terraform "Failed to get existing workspaces" from the S3 backend in CI

By Daniel Zoghalchali·Latchkey

During init the S3 backend lists objects under its key prefix to enumerate workspaces. When that ListObjects call is denied, the bucket or region is wrong, or the endpoint is unreachable, init fails before any plan can run.

What this error means

init fails with "Error: Failed to get existing workspaces" wrapping an S3 error such as AccessDenied, NoSuchBucket, or a region/endpoint mismatch.

Error: Failed to get existing workspaces: S3 bucket "my-tf-state" does not exist.

The referenced S3 bucket must have been created by the Terraform user before, or
the S3 backend "bucket" value must reference an existing bucket.

Common causes

The role cannot ListBucket on the state prefix

Listing objects to enumerate workspaces is denied, so init cannot read what state exists.

Wrong bucket name or region in the backend

A mistyped bucket or a region that does not match where the bucket lives makes the list call fail or hit the wrong endpoint.

How to fix it

Grant ListBucket and fix the backend target

1. Confirm the bucket name and region in the backend match reality.
2. Add s3:ListBucket on the bucket to the runner role.
3. Re-run init.

{
  "Effect": "Allow",
  "Action": ["s3:ListBucket"],
  "Resource": "arn:aws:s3:::my-tf-state"
}

Set the correct region and bucket

Pass the backend bucket and region explicitly so init targets the existing state location.

terraform init \
  -backend-config="bucket=my-tf-state" \
  -backend-config="region=us-east-1"

How to prevent it

• Grant ListBucket plus GetObject/PutObject on the state prefix.
• Keep backend bucket and region correct and in one config file.
• Create the state bucket before the first init.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation