policy runtime_error ai_generated true

错误：获取状态锁失败。锁信息：锁 ID：<id>。错误：ConditionalCheckFailedException：条件请求失败

Error: Error acquiring the state lock. Lock Info: Lock ID: <id>. Error: ConditionalCheckFailedException: The conditional request failed

ID: policy/terraform-state-lock-timeout-dynamodb

其他格式: JSON · Markdown 中文 · English
80%修复率
85%置信度
1证据数
2023-08-15首次发现

版本兼容性

版本状态引入弃用备注
Terraform v1.5.0 active — — —
Terraform v1.6.0 active — — —
DynamoDB standard table active — — —

根因分析

Terraform 通过 DynamoDB 的状态锁定在另一个进程持有锁超过默认重试超时时失败，通常是由于长时间运行的 apply 或过时的锁。

English

Terraform state locking via DynamoDB fails when another process holds the lock longer than the default retry timeout, often due to long-running applies or stale locks.

generic

官方文档

https://developer.hashicorp.com/terraform/language/settings/backends/s3#dynamodb-state-locking

解决方案

  1. 通过 AWS CLI 识别锁持有者：aws dynamodb get-item --table-name terraform-locks --key '{"LockID": {"S": "<lock-id>"}}'。如果持有者已过期，运行 terraform force-unlock -force <lock-id>。
  2. 在 terraform 块中增加锁重试超时：terraform { backend "s3" { lock_timeout = "5m" } } 以允许更长的等待。
  3. 实施预 apply 检查脚本，验证没有其他 CI 管道使用相同状态文件运行。

无效尝试

常见但无效的做法:

  1. 60% 失败

    Running terraform force-unlock without verifying the lock holder can corrupt the state if the original process is still running.

  2. 80% 失败

    Deleting the DynamoDB lock table entirely loses all lock state and requires reinitialization.

  3. 50% 失败

    Manually editing the DynamoDB item with incorrect permissions may cause AccessDenied errors.