Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

S3 - Delete objects after a notice period

0

I know that I can set up an S3 bucket where I could:

  • Auto delete files after 30 days (say)
  • Protect files from deletion for 30 days after creation, after which they can be instantly deleted.

I don't quite want either of those. I want to create Objects that are retained long term and, when someone requests deletion, they go into a "pending deletion" state for 30 days before being deleted. This should allow the user to cancel the deletion during the notice period. Is that possible, please?

I want to use it for protection against - for example - a hacker getting in and deleting the files. (Obviously, not letting the hacker in in the first place is ideal - but, defence in depth.)

Topics
Storage
Tags
Amazon Simple Storage Service
Language
English

asked 2 years ago616 views

1 Answer
2
Accepted Answer

"pending deletion" state for 30 days before being deleted is not possible

But what you can do is to enable S3 versioning

Versioning-enabled buckets can help you recover objects from accidental deletion or overwrite. For example, if you delete an object, Amazon S3 inserts a delete marker instead of removing the object permanently.

With versioning you can recover more easily from both unintended user actions and application failures.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html

EXPERT

answered 2 years ago

EXPERT

reviewed 2 years ago

EXPERT

reviewed 2 years ago

  • Paul
    2 years ago

    Thank you - that looks promising, yes.

    So I think I could "DELETE" the item, to mark it for deletion and then use NoncurrentVersionExpiration to delete non-current versions after 30 days? And the docs talk about using "DELETE Object versionId" to hard delete the object, but presumably I can ban that in policy so that the soft delete is the only option allowed?

  • Leo K EXPERT
    2 years ago

    Yes, Paul, you're exactly right on both counts. The permission for which to set a "Deny" statement in the policy to block "hard deletes" by users is s3:DeleteObjectVersion. The "soft-delete" action (when, and only when, versioning is enabled for the bucket) is s3:DeleteObject.

  • Paul
    2 years ago

    Thank you, Oleksii and Leo. I suspect I would have struggled to spot that.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content