Prevent accidental deletions from s3 bucket

Question

I have a bucket with versioning enabled.  Expired versions are removed after 30 days using a lifecycle rule.

I want to allow apps to soft-delete objects (i.e. they can issue a DeleteObject which will result in a delete marker, but the object remains in the bucket), but I do not want them to be able to *permanently* delete objects.

I was looking to enforce this with a bucket policy that has a Deny for everyone on s3:DeleteObjectVersion - but I want to make sure that this would not stop the lifecycle rule from working.  Is this something I need to worry about?

Riku_Kobayashi · Accepted Answer

Hello.

As stated in the following documentation, the object deletion action of an S3 lifecycle rule cannot be prevented by a bucket policy.  
In other words, the problem you are worried about will not occur.  
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html  
> General purpose buckets — You can't use a bucket policy to prevent deletions or transitions by an S3 Lifecycle rule. For example, even if your bucket policy denies all actions for all principals, your S3 Lifecycle configuration still functions as normal.

Prevent accidental deletions from s3 bucket

Add your answer

Relevant content