aws_s3: Bucket with removal policy = retain lose resource policy on `cdk destroy`
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Consider the following CDK app having a bucket that has `enforce_ssl=True` and `removal_policy=Retain`. On `cdk destroy` the bucket is retained, as expected, though the bucket resource policy is deleted.
```python
from aws_cdk import Stack, RemovalPolicy
from constructs import Construct
from aws_cdk import aws_s3 as s3
class CdkS3BugStack(Stack):
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)
s3.Bucket(
self,
"RetainBucketTest",
enforce_ssl=True,
removal_policy=RemovalPolicy.RETAIN
)
```
### Expected Behavior
The bucket's resource policy is retained as well
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::cdks3bugstack-retainbuckettestef48b7bf-ms4g1j3j8dy6",
"arn:aws:s3:::cdks3bugstack-retainbuckettestef48b7bf-ms4g1j3j8dy6/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
```
### Current Behavior
The bucket is retained, its resource policy is not.
### Reproduction Steps
Deploy the abovementioned app `cdk deploy`
Check the bucket resource policy, should contain the policy to disable non-SSL transport
Destroy the app `cdk destroy`
Check the bucket is still there, the policy is gone
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.93.0 (build 724bd01)
### Framework Version
_No response_
### Node.js Version
v18.14.2
### OS
Fedora 36
### Language
Python
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with the aws_s3.Bucket entry point and reproduce the behavior using the Python example: run cdk deploy, inspect the bucket policy, then run cdk destroy and inspect it again. Done means a bucket with removal_policy=Retain keeps its resource policy after destruction, including the enforce_ssl policy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100