Terraform "Failed to get existing workspaces" - S3 backend in CI

By Daniel Zoghalchali·Latchkey

To enumerate workspaces, the S3 backend lists objects under the state prefix. If the runner cannot list the bucket, init fails before any state is read.

What this error means

terraform init configuring the S3 backend fails with "Failed to get existing workspaces", usually wrapping an S3 AccessDenied, NoSuchBucket, or a region/endpoint mismatch.

Error: Failed to get existing workspaces: S3 bucket "tf-state-prod"
does not exist or you do not have permission to access it:
operation error S3: ListObjectsV2, https response error StatusCode: 403,
AccessDenied: Access Denied

Common causes

Missing or wrong AWS credentials

The runner has no usable credentials (no OIDC role, expired keys) so the ListObjectsV2 call is denied.

IAM lacks s3:ListBucket

The role can read objects but not list the bucket, which is what workspace enumeration needs.

Wrong region or bucket name

A region mismatch or a typo in the bucket/key makes the bucket appear nonexistent.

How to fix it

Confirm credentials and list permission

Verify the runner can list the state bucket with the same identity Terraform uses.

aws sts get-caller-identity
aws s3 ls s3://tf-state-prod/ --region us-east-1

Grant ListBucket on the state bucket

1. Add s3:ListBucket on the bucket ARN and s3:GetObject/s3:PutObject on the object ARNs.
2. Confirm the region in the backend block matches the bucket region.
3. For OIDC, confirm the trust policy allows the CI subject.

How to prevent it

• Use OIDC role assumption rather than long-lived keys in CI.
• Keep a least-privilege IAM policy that still includes ListBucket.
• Set region explicitly in the backend configuration.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation