aws / aws/aws-cdk

aws_s3: Bucket with removal policy = retain lose resource policy on `cdk destroy`

Open
#27,125 1 comment 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Consider the following CDK app having a bucket that has `enforce_ssl=True` and `removal_policy=Retain`. On `cdk destroy` the bucket is retained, as expected, though the bucket resource policy is deleted.

```python
from aws_cdk import Stack, RemovalPolicy
from constructs import Construct

from aws_cdk import aws_s3 as s3

class CdkS3BugStack(Stack):

def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)

s3.Bucket(
self,
"RetainBucketTest",
enforce_ssl=True,
removal_policy=RemovalPolicy.RETAIN
)
```

### Expected Behavior

The bucket's resource policy is retained as well

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::cdks3bugstack-retainbuckettestef48b7bf-ms4g1j3j8dy6",
"arn:aws:s3:::cdks3bugstack-retainbuckettestef48b7bf-ms4g1j3j8dy6/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
```

### Current Behavior

The bucket is retained, its resource policy is not.

### Reproduction Steps

Deploy the abovementioned app `cdk deploy`
Check the bucket resource policy, should contain the policy to disable non-SSL transport
Destroy the app `cdk destroy`
Check the bucket is still there, the policy is gone

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.93.0 (build 724bd01)

### Framework Version

_No response_

### Node.js Version

v18.14.2

### OS

Fedora 36

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the aws_s3.Bucket entry point and reproduce the behavior using the Python example: run cdk deploy, inspect the bucket policy, then run cdk destroy and inspect it again. Done means a bucket with removal_policy=Retain keeps its resource policy after destruction, including the enforce_ssl policy.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.