- disabled versioning on all buckets / enabled auto delete on stack deletion

- verified test completion

Author: Abdelhalim Dadouche

lib/build-image-data.ts

@@ -51,12 +51,12 @@ export class BuildImageDataStack extends cdk.Stack {
     // Create a bucket, then allow a deployment Lambda to upload to it.
     const dataBucket = new s3.Bucket(this, 'BuildImageDataBucket', {
       bucketName,
-      versioned: true,
+      versioned: false,
       encryptionKey: encryptionKey,
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true,
       enforceSSL: true,
       serverAccessLogsBucket: accessLoggingBucket,
+      autoDeleteObjects: true,
+      removalPolicy: RemovalPolicy.DESTROY,
     });
 
     const cwPolicy = new iam.PolicyDocument({

lib/build-image-pipeline.ts

@@ -128,7 +128,7 @@ export class BuildImagePipelineStack extends cdk.Stack {
        enableKeyRotation: true,
      });
       artifactBucket = new s3.Bucket(this, 'PipelineArtifacts', {
-        versioned: true,
+        versioned: false,
         enforceSSL: true,
         serverAccessLogsBucket: accessLoggingBucket,
         serverAccessLogsPrefix: props.serverAccessLogsPrefix,

lib/embedded-linux-codebuild-project.ts

@@ -94,8 +94,10 @@ export class EmbeddedLinuxCodebuildProjectStack extends cdk.Stack {
       accessLoggingBucket = props.accessLoggingBucket;
     } else {
       accessLoggingBucket = new s3.Bucket(this, "ArtifactAccessLogging", {
-        versioned: true,
+        versioned: false,
         enforceSSL: true,
+        autoDeleteObjects: true,
+        removalPolicy: RemovalPolicy.DESTROY,
       });
     }
 

lib/embedded-linux-pipeline.ts

@@ -150,9 +150,11 @@ export class EmbeddedLinuxPipelineStack extends cdk.Stack {
         outputBucket = props.outputBucket;
       } else {
         outputBucket = new s3.Bucket(this, 'PipelineOutput', {
-          versioned: true,
+          versioned: false,
           enforceSSL: true,
           serverAccessLogsBucket: accessLoggingBucket,
+          autoDeleteObjects: true,
+          removalPolicy: RemovalPolicy.DESTROY,
         });
       }
     }
@@ -167,7 +169,7 @@ export class EmbeddedLinuxPipelineStack extends cdk.Stack {
        enableKeyRotation: true,
      });
       artifactBucket = new s3.Bucket(this, 'PipelineArtifacts', {
-        versioned: true,
+        versioned: false,
         enforceSSL: true,
         serverAccessLogsBucket: accessLoggingBucket,
         encryptionKey,

test/__snapshots__/build-image-data.test.ts.snap

@@ -27,6 +27,7 @@ exports[`Build Image Data Snapshot 1`] = `
           "Ref": "BuildImageDataBucketE6A8BC04",
         },
         "Extract": true,
+        "OutputObjectKeys": true,
         "Prune": true,
         "ServiceToken": {
           "Fn::GetAtt": [
@@ -246,9 +247,6 @@ exports[`Build Image Data Snapshot 1`] = `
             "Value": "true",
           },
         ],
-        "VersioningConfiguration": {
-          "Status": "Enabled",
-        },
       },
       "Type": "AWS::S3::Bucket",
       "UpdateReplacePolicy": "Delete",
@@ -386,7 +384,7 @@ exports[`Build Image Data Snapshot 1`] = `
             [
               "Lambda function for auto-deleting objects in ",
               {
-                "Ref": "BuildImageDataBucketE6A8BC04",
+                "Ref": "LoggingBucket1E5A6F3B",
               },
               " S3 bucket.",
             ],
@@ -428,7 +426,7 @@ exports[`Build Image Data Snapshot 1`] = `
       "Type": "AWS::IAM::Role",
     },
     "LoggingBucket1E5A6F3B": {
-      "DeletionPolicy": "Retain",
+      "DeletionPolicy": "Delete",
       "Properties": {
         "AccessControl": "LogDeliveryWrite",
         "OwnershipControls": {
@@ -438,12 +436,34 @@ exports[`Build Image Data Snapshot 1`] = `
             },
           ],
         },
-        "VersioningConfiguration": {
-          "Status": "Enabled",
-        },
+        "Tags": [
+          {
+            "Key": "aws-cdk:auto-delete-objects",
+            "Value": "true",
+          },
+        ],
       },
       "Type": "AWS::S3::Bucket",
-      "UpdateReplacePolicy": "Retain",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "LoggingBucketAutoDeleteObjectsCustomResource3835D361": {
+      "DeletionPolicy": "Delete",
+      "DependsOn": [
+        "LoggingBucketPolicy21938756",
+      ],
+      "Properties": {
+        "BucketName": {
+          "Ref": "LoggingBucket1E5A6F3B",
+        },
+        "ServiceToken": {
+          "Fn::GetAtt": [
+            "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
+            "Arn",
+          ],
+        },
+      },
+      "Type": "Custom::S3AutoDeleteObjects",
+      "UpdateReplacePolicy": "Delete",
     },
     "LoggingBucketPolicy21938756": {
       "Properties": {
@@ -486,6 +506,45 @@ exports[`Build Image Data Snapshot 1`] = `
                 },
               ],
             },
+            {
+              "Action": [
+                "s3:PutBucketPolicy",
+                "s3:GetBucket*",
+                "s3:List*",
+                "s3:DeleteObject*",
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": {
+                  "Fn::GetAtt": [
+                    "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
+                    "Arn",
+                  ],
+                },
+              },
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "LoggingBucket1E5A6F3B",
+                    "Arn",
+                  ],
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "LoggingBucket1E5A6F3B",
+                          "Arn",
+                        ],
+                      },
+                      "/*",
+                    ],
+                  ],
+                },
+              ],
+            },
           ],
           "Version": "2012-10-17",
         },