title: Terraform: Give permissions to ElastiCache user to export to S3 Bucket
body: <p>I would like to export snapshots from ElastiCache to S3. This is relatively easy to set up manually by following <a href="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups-exporting.html#backups-exporting-grant-access" rel="nofollow noreferrer">the documentation</a>. However, I would like to do this programatically by using terraform. </p>
  
  <p>In the documentation it states:</p>
  
  <pre><code>5. Choose Access Control List.
  
  &lt;snip /&gt;
  
  8. Set the permissions on the bucket by choosing Yes for:
     a. List objects
     b. Write objects
     c. Read bucket permissions
  </code></pre>
  
  <p>I haven't been able to find anywhere in <a href="https://www.terraform.io/docs/providers/aws/r/s3_bucket.html" rel="nofollow noreferrer">the Terraform documentation</a> where I can set these permissions on the bucket. I did find <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#permissions" rel="nofollow noreferrer">some documentation</a> that maps the above permissions to IAM policies permissions and I applied these in the bucket policy. Unfortunately, I still get the following error:</p>
  
  <blockquote>
    <p>An error occurred (InvalidParameterValue) when calling the CopySnapshot operation: Elasticache has not been granted ReadACP permissions on the S3 bucket my-backups</p>
  </blockquote>
  
  <p><strong>CODE</strong></p>
  
  <p>Setting up S3 Bucket:</p>
  
  <pre><code>data "aws_iam_policy_document" "my_backups" {
    statement {
      actions = [
        "s3:GetBucketAcl",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:DeleteObject",
      ]
  
      resources = [
        "arn:aws:s3:::my-backups",
        "arn:aws:s3:::my-backups/*",
      ]
  
      principals {
        type        = "CanonicalUser"
        identifiers = ["540804c33a284a299d2547575ce1010f2312ef3da9b3a053c8bc45bf233e4353"]
      }
    }
  }
  
  resource "aws_s3_bucket" "my_backups" {
    bucket = "my-backups"
    policy = "${data.aws_iam_policy_document.my_backups.json}"
  }
  </code></pre>
  
  <p><strong>GITHUB</strong></p>
  
  <p>I found two issues (with code that hasn't been merged) that relate to this:</p>
  
  <ol>
  <li><a href="https://github.com/terraform-providers/terraform-provider-aws/pull/3757" rel="nofollow noreferrer">Support bucket ACLs</a></li>
  <li><a href="https://github.com/terraform-providers/terraform-provider-aws/pull/3728" rel="nofollow noreferrer">Implementation of acl grants</a></li>
  </ol>
  
  <p>I'm guessing this may not be possible until one of these two issues is resolved.</p>