Chapter 40: Terraform Real AWS Labs VPC EC2 nginx S3 and IAM Role

40.5 Lab part 5 — a private S3 bucket, then destroy everything

By Ravindra Bagale · Last updated: 25 October 2026

Story. An Instagram-style team stores static assets in S3 and must never make the bucket public by accident. The bucket gets public access fully blocked, encryption on, and force_destroy only in the lab so destroy can empty it. Then comes the most important step of every lab: terraform destroy, and confirm nothing is left running to avoid cost.

resource "aws_s3_bucket" "assets" {
  bucket        = "badge-lab-assets-<your-account-id>"
  force_destroy = true
}

resource "aws_s3_bucket_public_access_block" "assets" {
  bucket                  = aws_s3_bucket.assets.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_object" "hello" {
  bucket  = aws_s3_bucket.assets.id
  key     = "hello.txt"
  content = "served through the instance role"
}

# from a Session Manager shell on the instance
aws s3 cp s3://badge-lab-assets-<your-account-id>/hello.txt -

# back on your machine
terraform destroy

What each line does

• bucket = "badge-lab-assets-<your-account-id>" — Unique name; replace the placeholder.
• force_destroy = true — Lets destroy delete a bucket that still has objects; lab only.
• block_public_acls = true (and the three lines after) — Blocks all public access.
• resource "aws_s3_object" "hello" { — Uploads one small test object.
• content = "served through the instance role" — The object body.
• aws s3 cp s3://.../hello.txt - — Reads the object on the server using the role; no keys configured.
• terraform destroy — Deletes every lab resource to avoid cost.

When it is green.

served through the instance role

Plan: 0 to add, 0 to change, 18 to destroy.
Destroy complete! Resources: 18 destroyed.

When it is red.

download failed: s3://badge-lab-assets-.../hello.txt to - An error occurred (AccessDenied)
when calling the GetObject operation: Access Denied

Fix. The role policy resource ARN is wrong, or the instance profile is missing. Check part 4 and remember the /* at the end of the bucket ARN.

What: every term in plain English

• public access block — Four settings that stop any ACL or policy from making the bucket public.
• server-side encryption — S3 encrypts every object on disk. SSE-S3 is free; SSE-KMS uses a KMS key.
• force_destroy — Lets terraform destroy delete a bucket that still has objects. Use only in labs.
• aws_s3_object — A Terraform resource that uploads one file to a bucket.
• etag — A hash of the object. Terraform uses filemd5 to notice when the file changes.
• destroy plan — terraform plan -destroy shows what will be deleted before you delete it.
• leftover check — Commands run after destroy to prove nothing is still billing.

Example 1: Upload a test object with Terraform

A Nykaa team ships its config files to S3 through Terraform, so every change is reviewed. Do the same with one small file.

1. Create hello.txt with printf.
2. Add an aws_s3_object resource.
3. Apply.

resource "aws_s3_object" "hello" {
  bucket = aws_s3_bucket.assets.id
  key    = "hello.txt"
  source = "${path.module}/hello.txt"
  etag   = filemd5("${path.module}/hello.txt")
}

printf 'Hello from the badge lab\n' > hello.txt
terraform apply -auto-approve
aws s3 ls s3://badge-lab-assets-123456789012/

Output

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
2026-10-25 12:20:44         25 hello.txt

What it shows: Change hello.txt and plan again; the etag changes, so Terraform uploads the new version.

Example 2: Prove the bucket is private

Every quarter, auditors at a Bajaj Finserv vendor try the public URL. Do it yourself first.

1. Try the public object URL with curl.
2. Read the public access block.

curl -s -o /dev/null -w "%{http_code}\n" https://badge-lab-assets-123456789012.s3.ap-south-1.amazonaws.com/hello.txt
aws s3api get-public-access-block --bucket badge-lab-assets-123456789012 --output text

Output

403
PUBLICACCESSBLOCKCONFIGURATION  True    True    True    True

What it shows: 403 from outside and all four blocks True. Only the role can read it.

Example 3: Read the destroy plan before destroying

At a Jio project, a destroy ran in the wrong folder and removed a shared VPC. Reading the destroy plan takes ten seconds and prevents that.

1. Run terraform workspace show and pwd.
2. Run plan -destroy.
3. Count the resources.

pwd; terraform workspace show
terraform plan -destroy | tail -1
terraform destroy -auto-approve | tail -1

Output

/home/ravi/aws-lab
default
Plan: 0 to add, 0 to change, 17 to destroy.
Destroy complete! Resources: 17 destroyed.

What it shows: The count matches what you built across the five parts. Right folder, right workspace, then destroy.

Example 4: Check nothing is left running

A forgotten instance from a weekend lab is the most common surprise bill. Run three checks after every destroy.

1. List lab instances.
2. List lab buckets.
3. Check state is empty.

aws ec2 describe-instances --filters Name=tag:Project,Values=badge-lab Name=instance-state-name,Values=running \
  --query "length(Reservations)"
aws s3 ls | grep badge-lab || echo "no lab buckets"
terraform state list | wc -l

Output

0
no lab buckets
0

What it shows: Zero running, zero buckets, empty state. The default_tags from part 1 make this check easy.

Command cheat sheet

Verify: did it work?

1. Bucket is private

   curl -s -o /dev/null -w "%{http_code}" https://badge-lab-assets-123456789012.s3.ap-south-1.amazonaws.com/hello.txt
   

   Output

   403
   

2. State empty after destroy

   terraform state list | wc -l
   

   Output

   0
   

When it is red 1

Error: deleting S3 Bucket: BucketNotEmpty: The bucket you tried to delete is not empty

Cause. Objects remain and force_destroy is false.

Fix, step by step

1. Set force_destroy = true for the lab and apply.
2. Run destroy again.
3. Or empty the bucket with aws s3 rm --recursive.

When it is red 2

Error: creating S3 Bucket: BucketAlreadyExists

Cause. Bucket names are global and someone owns that name.

Fix, step by step

1. Add your account id to the name.
2. Plan again.

When it is red 3

Error: deleting EC2 VPC: DependencyViolation

Cause. Something made by hand is still in the VPC, such as an ENI or a security group.

Fix, step by step

1. Find it with describe-network-interfaces filtered by VPC.
2. Delete it in the console.
3. Run destroy again.

Cleanup

terraform destroy -auto-approve
rm -f hello.txt

Practice tasks

Homework: try at home

Recap

• Block public access and encrypt every bucket.
• force_destroy only in labs.
• Upload files with aws_s3_object and filemd5.
• Read plan -destroy, then destroy.
• Prove nothing is left with three checks.

FAQ

Is force_destroy safe in prod?

No. It deletes all objects. Keep it false outside labs.

Is SSE-S3 enough?

For most labs and many apps, yes. Use KMS when you need key control or audit.

Why 403 and not 404?

S3 hides whether the object exists from callers who are not allowed.

Can I destroy one part only?

Use -target only for emergencies. For labs, destroy all.

What costs money in this lab?

The EC2 instance and its public IPv4 address. The rest is almost free.

Interview questions

1. How do you keep an S3 bucket private with Terraform?

   aws_s3_bucket_public_access_block with all four settings true, plus encryption.

2. What is force_destroy?

   Allows deleting a non-empty bucket on destroy.

3. How do you upload a file with Terraform?

   aws_s3_object with source and etag = filemd5.

4. How do you avoid destroying the wrong thing?

   Check folder and workspace, read plan -destroy.

5. How do you confirm nothing is left after a lab?

   Check instances, buckets and an empty state list.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards