ConditionalCheckFailedException terraform resource_error ai_generated true

Error: Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed: The conditional request failed because the lock has expired

ID: terraform/terraform-state-push-lock-expired

Also available as: JSON · Markdown · 中文
88%Fix Rate
86%Confidence
1Evidence
2024-05-18First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.5.0 active — — —
1.6.0 active — — —
1.7.0 active — — —
1.8.0 active — — —

Root Cause

A state lock was acquired but expired (e.g., due to a long-running operation or stale lock), and Terraform's conditional update check failed because the lock item's version no longer matches.

generic

中文

状态锁已被获取但已过期（例如，由于长时间运行的操作或过时的锁），并且 Terraform 的条件更新检查失败，因为锁项的版本不再匹配。

Official Documentation

https://developer.hashicorp.com/terraform/language/settings/backends/s3#dynamodb_table

Workarounds

  1. 90% success Force unlock the state using the lock ID: terraform force-unlock <LOCK_ID>. First, get the lock ID from the error message or by inspecting the DynamoDB table: aws dynamodb get-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' --projection-expression "LockID, Digest". Then run terraform force-unlock <LOCK_ID>. 
    Force unlock the state using the lock ID: terraform force-unlock <LOCK_ID>. First, get the lock ID from the error message or by inspecting the DynamoDB table: aws dynamodb get-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' --projection-expression "LockID, Digest". Then run terraform force-unlock <LOCK_ID>.
  2. 85% success If the lock ID is not available, manually delete the lock item from DynamoDB after confirming no Terraform process is running: aws dynamodb delete-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' 
    If the lock ID is not available, manually delete the lock item from DynamoDB after confirming no Terraform process is running: aws dynamodb delete-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}'
  3. 80% success Increase the lock timeout in the backend configuration to prevent future expiration: backend "s3" { ... dynamodb_table = "terraform-lock" lock_timeout = "5m" } 
    Increase the lock timeout in the backend configuration to prevent future expiration: backend "s3" { ... dynamodb_table = "terraform-lock" lock_timeout = "5m" }

中文步骤

  1. 使用锁 ID 强制解锁状态：terraform force-unlock <LOCK_ID>。首先从错误消息中获取锁 ID，或通过检查 DynamoDB 表：aws dynamodb get-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' --projection-expression "LockID, Digest"。然后运行 terraform force-unlock <LOCK_ID>。
  2. 如果锁 ID 不可用，请在确认没有 Terraform 进程运行后手动从 DynamoDB 删除锁项：aws dynamodb delete-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}'
  3. 在后端配置中增加锁超时时间以防止将来过期：backend "s3" { ... dynamodb_table = "terraform-lock" lock_timeout = "5m" }

Dead Ends

Common approaches that don't work:

  1. Manually delete the DynamoDB lock item using AWS CLI without checking who holds the lock. 70% fail

    This can cause state corruption if another Terraform process is still running; it should only be done after confirming no active operations.

  2. Re-run terraform apply immediately without force-unlocking. 90% fail

    The expired lock still exists in DynamoDB, so the new attempt will also fail with the same error.

  3. Change the backend configuration to use a different DynamoDB table. 80% fail

    This creates a new lock table but doesn't resolve the stale lock in the original table; state operations will still fail.