fix(s3): bucket deletion fails if object creation races against cleanup

[miles-po]

Adds a DENY policy for S3:PutObject on buckets to be auto-deleted to prevent a race condition on emptying with external bucket writers.

As a new contributor, the requirements for integration testing were unclear to me. I have tested the policy on my own buckets and included unit tests, but am willing to work toward code compliance with assistance.

Closes #26874.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[miles-po]

Clarification Request: As a new contributor, the requirements for integration testing were unclear to me. I have tested the policy on my own buckets and included unit tests, but am willing to work toward code compliance with assistance.

[rix0rrr]

This document should be mostly accurate explaining what they are and how they should be run.

You don't need to add a new one, but you probably will need to update some existing snapshots. You'll need AWS account credentials to run the actual tests in.

The tests are in packages/@aws-cdk-testing/framework-integ these days.

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

[mrgrain]

@miles-po Thanks for this! Are you still interested in wrapping this up? If you can get the unit tests passing and update the integration test snapshots with --dry-run, that'd be great. Once that's done I can verify for you that the integ tests are working and get it shipped.

[miles-po]

Family's been ill, so I've been playing catch-up. I started working on it again late yesterday. Was hoping to finish up today.

[miles-po]

@mrgrain I added some fixes including unit test repair. I keep getting an integration test failure in the cdk-s3-bucket-auto-delete-objects stack. I obviously can't rule out user error, but looking back at the code, I can't find why my additions would cause a missing bucket error. Would appreciate any help I can get as I fear I've taken it as far as I know how in this codebase.

[miles-po]

And after fixing one set of unit tests, I broke another. Lemme fix that before I ask for more help. (Oops!)

[miles-po]

@mrgrain Made my fixes. Appears to me the only failures are now snapshot failures. Been trying to get the integration tests to work in a sandbox account, following the contributors instructions as close as I know how, but nothing I try seems to work. If they work for you, I owe you a beverage of your choice for getting the snapshots to work. If not, I'm here to help with the code debugging process and answer any questions I can.

[miles-po]

@mrgrain I didn't run --dry-run because the contributing instructions specifically said:

If you are working on a PR that requires an update to an integration test and you are unable to run the cdk-integ tool to perform a real deployment, please call this out on the pull request so a maintainer can run the tests for you. Please do not run the cdk-integ tool with --dry-run or manually update the snapshot.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[miles-po]

@mrgrain @rix0rrr Thank you both so much for pushing this through!

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: a4d1cee
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).