S3 bucket getting created automatically after deleting CF stack and the bucket created by CF stack

By default, when you delete a CloudFormation stack, all resources created by that stack are also deleted, including S3 buckets.

Using the DeletionPolicy attribute in your CloudFormation template to specify what should happen to a resource when the stack is deleted. For S3 buckets, you can set it to "Retain" to keep the bucket even after stack deletion. Since the bucket wasn't automatically deleted with the stack, and you had to delete it manually. It seems like the "Retain" setting may be set on the bucket that was created. If the desire is for the bucket to be deleted, then the DeletionPolicy to "Delete" explicitly.

My understanding of what you are describing in 4. is abnormal behavior, I would suggest reaching out to your account team or submitting a support ticket on this to further investigate.

Some steps that you can take prior to doing that, that will help either the account team or support I recommend the following steps:

• Check for Automated Processes:

  Review any automated scripts, Lambda functions, or other AWS services that might be creating buckets or uploading files. Look for any CloudFormation templates that might be automatically deploying.

• Investigate CloudTrail Logs: Use AWS CloudTrail to investigate who or what is creating the S3 bucket and uploading files. Look for events related to S3 bucket creation and object uploads.

• Check IAM Permissions: Review the IAM permissions of your users and roles to ensure there are no overly permissive policies allowing unintended S3 actions.

-Implement S3 Bucket Policies: Consider implementing restrictive bucket policies to prevent unauthorized uploads.

-Enable S3 Access Logging: Enable S3 access logging to monitor and audit access to your S3 resources.

-Use AWS Config: Set up AWS Config rules to monitor for unexpected S3 bucket creations or modifications.

-Implement CloudWatch Alarms: Set up CloudWatch alarms to alert you when there are unexpected spikes in S3 API calls.

Thank you very much for the answer. I deleted the IAM user,no bucket left out but still the issue occurs. Raised a ticket for the same.