aws / aws/aws-cdk

custom-resource-handlers/aws-s3/auto-delete-objects-handler: Object locked objects prevent cdk destroy

Open
#32,147 2 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When an s3 bucket is created with object lock governance and the s3 bucket is set for removal cdk destroy fails. This happens even when the role has permissions to bypassgovernancelock

This is because in the auto-delete-objects-handler the s3 delete objects is called without `BypassGovernanceRetention`

Current: `await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records } });`

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

I expect for the cdk destroy to remove the governed objects provided the role has the necessary permissions

### Current Behavior

The cdk destroy fails and the stack reverts back to its previous state

### Reproduction Steps

```
import * as s3 from 'aws-cdk-lib/aws-s3'
import * as cdk from 'aws-cdk-lib'
new s3.Bucket(scope, 'testID', {
autoDeleteObjects: true,
removalPolicy: cdk.RemovalPolicy.DESTROY,
versioned: true,
objectLockDefaultRetention: s3.ObjectLockRetention.governance(
cdk.Duration.days(7)
)
})
```
Add some objects, then run cdk destroy

### Possible Solution

`await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records }, BypassGovernanceRetention: true });`

The above will work for governed objects however will fail for non object locked objects. For this reason a combination of the two will need to be used

### Additional Information/Context

_No response_

### CDK CLI Version

2.160.0 (build 7a8ae02)

### Framework Version

_No response_

### Node.js Version

v21.7.1

### OS

MacOS 14.7.1

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in custom-resource-handlers/aws-s3/auto-delete-objects-handler and inspect the deleteObjects call described in the issue. Run the provided object-lock bucket reproduction with both governed and non-object-locked objects. Done means cdk destroy removes governed objects when permitted without breaking deletion of ordinary objects.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.