custom-resource-handlers/aws-s3/auto-delete-objects-handler: Object locked objects prevent cdk destroy
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When an s3 bucket is created with object lock governance and the s3 bucket is set for removal cdk destroy fails. This happens even when the role has permissions to bypassgovernancelock
This is because in the auto-delete-objects-handler the s3 delete objects is called without `BypassGovernanceRetention`
Current: `await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records } });`
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
_No response_
### Expected Behavior
I expect for the cdk destroy to remove the governed objects provided the role has the necessary permissions
### Current Behavior
The cdk destroy fails and the stack reverts back to its previous state
### Reproduction Steps
```
import * as s3 from 'aws-cdk-lib/aws-s3'
import * as cdk from 'aws-cdk-lib'
new s3.Bucket(scope, 'testID', {
autoDeleteObjects: true,
removalPolicy: cdk.RemovalPolicy.DESTROY,
versioned: true,
objectLockDefaultRetention: s3.ObjectLockRetention.governance(
cdk.Duration.days(7)
)
})
```
Add some objects, then run cdk destroy
### Possible Solution
`await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records }, BypassGovernanceRetention: true });`
The above will work for governed objects however will fail for non object locked objects. For this reason a combination of the two will need to be used
### Additional Information/Context
_No response_
### CDK CLI Version
2.160.0 (build 7a8ae02)
### Framework Version
_No response_
### Node.js Version
v21.7.1
### OS
MacOS 14.7.1
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in custom-resource-handlers/aws-s3/auto-delete-objects-handler and inspect the deleteObjects call described in the issue. Run the provided object-lock bucket reproduction with both governed and non-object-locked objects. Done means cdk destroy removes governed objects when permitted without breaking deletion of ordinary objects.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100