错误：获取状态锁时出错：ConditionalCheckFailedException：条件请求失败：条件请求失败，因为锁已过期
Error: Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed: The conditional request failed because the lock has expired
ID: terraform/terraform-state-push-lock-expired
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| 1.5.0 | active | — | — | — |
| 1.6.0 | active | — | — | — |
| 1.7.0 | active | — | — | — |
| 1.8.0 | active | — | — | — |
根因分析
状态锁已被获取但已过期（例如，由于长时间运行的操作或过时的锁），并且 Terraform 的条件更新检查失败，因为锁项的版本不再匹配。
English
A state lock was acquired but expired (e.g., due to a long-running operation or stale lock), and Terraform's conditional update check failed because the lock item's version no longer matches.
官方文档
https://developer.hashicorp.com/terraform/language/settings/backends/s3#dynamodb_table解决方案
-
使用锁 ID 强制解锁状态：terraform force-unlock <LOCK_ID>。首先从错误消息中获取锁 ID，或通过检查 DynamoDB 表：aws dynamodb get-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' --projection-expression "LockID, Digest"。然后运行 terraform force-unlock <LOCK_ID>。 -
如果锁 ID 不可用，请在确认没有 Terraform 进程运行后手动从 DynamoDB 删除锁项：aws dynamodb delete-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' -
在后端配置中增加锁超时时间以防止将来过期：backend "s3" { ... dynamodb_table = "terraform-lock" lock_timeout = "5m" }
无效尝试
常见但无效的做法:
-
Manually delete the DynamoDB lock item using AWS CLI without checking who holds the lock.
70% 失败
This can cause state corruption if another Terraform process is still running; it should only be done after confirming no active operations.
-
Re-run terraform apply immediately without force-unlocking.
90% 失败
The expired lock still exists in DynamoDB, so the new attempt will also fail with the same error.
-
Change the backend configuration to use a different DynamoDB table.
80% 失败
This creates a new lock table but doesn't resolve the stale lock in the original table; state operations will still fail.