Terraform -- Failed to save state - terraform

Question

need your help. I try to create policy which won't allow to upload objects which aren't encrypted either KMS or SSE. Also, I use s3 state bucket and dynamodb lock. Backend with s3 has encryption key KMS. During my creation I apply policy to the bucket which stores my terraform state file, it applies and then throw the following error:
│ Error: Failed to save state
│
│ Error saving state: failed to upload state: AccessDenied: Access Denied
│ status code: 403, request id: ************************, host id: **********************************
╵
╷
│ Error: Failed to persist state to backend
│
│ The error shown above has prevented Terraform from writing the updated state to the configured backend. To allow for recovery, the state has been written to the file "errored.tfstate" in the current working
│ directory.
│
│ Running "terraform apply" again at this point will create a forked state, making it harder to recover.
│
│ To retry writing this state, use the following command:
│ terraform state push errored.tfstate
│
My backend
backend "s3" {
profile = "default"
bucket = "bucket_name"
key = "my_state.tfstate"
region = "region"
kms_key_id = "arn_to_key"
dynamodb_table = "state_table"
}
Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Sid_1",
"Effect": "Deny",
"Principal": {
"AWS": [
"arn_to_account_role",
"arn_to_account_role"
]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::bucket_name/*",
"Condition": {
"Null": {
"s3:x-amz-server-side-encryption": "true"
}
}
},
{
"Sid": "Sid_2",
"Effect": "Deny",
"Principal": {
"AWS": [
"arn_to_account_role",
"arn_to_account_role"
]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::bucket_name/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": [
"aws:kms",
"AES256"
]
}
}
}
]
}
Current version terraform which I use is Terraform v0.15.4
Provider of AWS is ~> 3.20.0

Answer 1

Try adding encrypt = true to your backend config
backend "s3" {
profile = "default"
bucket = "bucket_name"
key = "my_state.tfstate"
region = "region"
kms_key_id = "arn_to_key"
dynamodb_table = "state_table"
encrypt = true
}