S3 general purpose buckets should have Lifecycle configurations

How to fix it

• Can't be undone: An expiration action also acts on objects already stored, and on an unversioned bucket it deletes them permanently, so settle the period before you create the rule.
• Affects another check: A rule also clears S3.10 on a versioned bucket, and S3.20 no longer reports the bucket; if MFA delete is on, turn it off first, since S3 does not support lifecycle rules alongside it.
• Overwrites existing settings: The CLI and Terraform routes replace the bucket's whole lifecycle configuration, so include the rules it already has, disabled ones too, or they are deleted.

In the console

S3 → the bucket → Management → Lifecycle rules

Lifecycle rule actions

Delete expired object delete markers or incomplete multipart uploads

Delete incomplete multipart uploads

Select it with a few days, such as 7: those parts are billed as storage but never appear in the object list

With the AWS CLI

aws s3api put-bucket-lifecycle-configuration --bucket <bucket-name> --lifecycle-configuration file://lifecycle.json

With Terraform

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = var.bucket_name

  rule {
    id     = "abort-incomplete-multipart-uploads"
    status = "Enabled"

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}