# 错误：获取状态锁时出错：ConditionalCheckFailedException：条件请求失败：条件请求失败，因为锁已过期

- **ID:** `terraform/terraform-state-push-lock-expired`
- **领域:** terraform
- **类别:** resource_error
- **错误码:** `ConditionalCheckFailedException`
- **验证级别:** ai_generated
- **修复率:** 88%

## 根因

状态锁已被获取但已过期（例如，由于长时间运行的操作或过时的锁），并且 Terraform 的条件更新检查失败，因为锁项的版本不再匹配。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 1.5.0 | active | — | — |
| 1.6.0 | active | — | — |
| 1.7.0 | active | — | — |
| 1.8.0 | active | — | — |

## 解决方案

1. ```
   使用锁 ID 强制解锁状态：terraform force-unlock <LOCK_ID>。首先从错误消息中获取锁 ID，或通过检查 DynamoDB 表：aws dynamodb get-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}' --projection-expression "LockID, Digest"。然后运行 terraform force-unlock <LOCK_ID>。
   ```
2. ```
   如果锁 ID 不可用，请在确认没有 Terraform 进程运行后手动从 DynamoDB 删除锁项：aws dynamodb delete-item --table-name terraform-lock --key '{"LockID": {"S": "<state-file-path>"}}'
   ```
3. ```
   在后端配置中增加锁超时时间以防止将来过期：backend "s3" { ... dynamodb_table = "terraform-lock" lock_timeout = "5m" }
   ```

## 无效尝试

- **Manually delete the DynamoDB lock item using AWS CLI without checking who holds the lock.** — This can cause state corruption if another Terraform process is still running; it should only be done after confirming no active operations. (70% 失败率)
- **Re-run terraform apply immediately without force-unlocking.** — The expired lock still exists in DynamoDB, so the new attempt will also fail with the same error. (90% 失败率)
- **Change the backend configuration to use a different DynamoDB table.** — This creates a new lock table but doesn't resolve the stale lock in the original table; state operations will still fail. (80% 失败率)