S3 directory buckets should have lifecycle configurations

How to fix it

• Can't be undone: Expiration also acts on objects already in the bucket, and directory buckets keep no versions, so an expired object is deleted for good; settle the period first.
• Overwrites existing settings: The CLI and Terraform routes replace the bucket's whole lifecycle configuration, so include the rules it already has, disabled ones too, or they are deleted.

Settings

Rules[].Status

Enabled; a rule left Disabled does not count

Rules[].Expiration.Days

The age in days at which objects expire, such as 7; expiry is one of only two actions directory buckets support

Rules[].AbortIncompleteMultipartUpload.DaysAfterInitiation

A few days, such as 7, the other action; in the same rule or its own

Bucket policy (aws s3api put-bucket-policy)

A statement letting lifecycle.s3.amazonaws.com call s3express:CreateSession in ReadWrite mode, or rules delete nothing

With the AWS CLI

aws s3api put-bucket-lifecycle-configuration --bucket <directory-bucket-name> --lifecycle-configuration file://lifecycle.json --region <region>

With Terraform

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = var.directory_bucket_name

  rule {
    id     = "expire-objects"
    status = "Enabled"

    expiration {
      days = 7
    }
  }
}