⚙️ OpenTofu Error: S3 backend 'bucket does not exist' (NoSuchBucket) on init

Exact Error Message

Initializing the backend...
╷
│ Error: Failed to get existing workspaces: S3 bucket "my-tofu-state" does not exist.
│
│ The referenced S3 bucket must have been previously created. If the S3 bucket
│ was created within the last minute, please wait for a minute or two and try
│ again.
│
│ Error: operation error S3: ListObjectsV2, https response error StatusCode: 404,
│ api error NoSuchBucket: The specified bucket does not exist
╵

What It Means

When you run tofu init with an S3 backend, OpenTofu immediately tries to list the existing workspaces by reading from the configured bucket. If S3 returns NoSuchBucket (HTTP 404), OpenTofu cannot find a bucket with that exact name in the account and region it is authenticated against, and initialization fails before any state is read or written.

The message is literal: as far as the credentials and region OpenTofu is using, that bucket does not exist. That can mean the bucket truly is missing, or that you are looking in the wrong region or account, or that a typo/interpolation left the name wrong.

Common Causes

• The state bucket was never created (chicken-and-egg: you cannot store state in a bucket that OpenTofu itself has not yet made).
• A typo in the bucket value or a stray environment prefix.
• The region in the backend block does not match where the bucket actually lives.
• Credentials resolve to the wrong AWS account (different profile, assumed role, or CI identity).
• Pointing at a non-AWS S3-compatible endpoint (MinIO, R2, Ceph) without setting endpoints/use_path_style.
• The bucket was recently deleted, or created seconds ago and not yet consistent.

Diagnostic Commands

Confirm which identity OpenTofu is actually using:

aws sts get-caller-identity

Check whether the bucket exists and in which region:

aws s3api head-bucket --bucket my-tofu-state
aws s3api get-bucket-location --bucket my-tofu-state

List buckets visible to these credentials:

aws s3 ls | grep tofu-state

Re-run init with debug logging to see the exact request:

TF_LOG=debug tofu init 2>&1 | grep -i "s3\|bucket\|region"

Step-by-Step Resolution

1. Verify the backend block matches reality. The bucket name is case-sensitive and globally unique:

terraform {
  backend "s3" {
    bucket = "my-tofu-state"
    key    = "prod/network/terraform.tfstate"
    region = "us-east-1"
  }
}

2. Confirm the region. If get-bucket-location returns eu-west-1 but your backend says us-east-1, fix the region value.

3. If the bucket genuinely does not exist, create it (and enable versioning) before initializing OpenTofu:

aws s3api create-bucket --bucket my-tofu-state --region us-east-1
aws s3api put-bucket-versioning \
  --bucket my-tofu-state \
  --versioning-configuration Status=Enabled

4. If credentials point at the wrong account, select the correct profile and re-init:

export AWS_PROFILE=prod
tofu init

5. For an S3-compatible store (MinIO/R2/Ceph), set the custom endpoint and path style:

terraform {
  backend "s3" {
    bucket = "my-tofu-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
    endpoints = { s3 = "https://minio.internal:9000" }
    use_path_style              = true
    skip_credentials_validation = true
    skip_region_validation      = true
  }
}

6. Re-run init and confirm the backend attaches:

tofu init -reconfigure

Successfully configured the backend "s3"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Prevention

• Bootstrap the state bucket (and lock table) in a separate, minimal root module with a local backend, before any team module uses S3.
• Pin the region explicitly and keep it in sync with where the bucket actually lives.
• Enable bucket versioning so you can recover state after accidental overwrites or deletes.
• Standardize the AWS identity used in CI so init never runs against the wrong account.
• Use -backend-config files per environment instead of hand-editing the bucket value.

Related Errors

• AccessDenied on the S3 backend — the bucket exists but your identity lacks s3:ListBucket/GetObject.
• ResourceNotFoundException — the DynamoDB lock table is missing (a separate backend dependency).
• Backend initialization required — the backend config changed and tofu init must be re-run.
• Error refreshing state: BucketRegionError — the bucket lives in a different region than configured.

Frequently Asked Questions

Why does init fail if I just created the bucket? S3 can take a minute to become consistent. Wait a moment and re-run tofu init, as the error message itself suggests.

Can OpenTofu create its own state bucket? Not for its own backend. You must create the bucket out-of-band (CLI, a bootstrap module with a local backend) before pointing a backend at it.

How do I know I’m hitting the wrong account? Run aws sts get-caller-identity and compare the account ID to where the bucket lives. A mismatched profile or CI role is the usual culprit.

Does this work with MinIO or Cloudflare R2? Yes, set endpoints.s3, use_path_style = true, and the skip flags. See the prompt library for backend bootstrap templates and more OpenTofu guides.