AWS S3 DeletionPolicy - Add after creation and verify setting

user_45580 0
Viewed 1252

I've created a bucket without a DeletionPolicy and want to add it. Updated our configuration (in our serverless.yml), and we now see the DeletionPolicy: retain in the cloud-formation template.

However, based on this blurb:

One quirk in the update template workflow is that DeletionPolicy cannot be updated by itself but must accompany some other change that "add, modify or delete properties" of an existing resource. A fun fact about the AWS::S3::Bucket resource: it cannot be updated after creation. Good news: this does not apply to the DeletionPolicy attribute. Bad news: CFN won't pick up the changes unless another property of the "immutable" S3 bucket is updated.

I've searched for quite a while, and I cannot determine how to query the S3 bucket and determine if the DeletionPolicy is actually set or not. I don't see where this is exposed in the AWS console, nor do I see in the AWS cli where this can be queried. It doesn't appear to be in the Bucket Policy as far as I can tell.

How do I validate the DeletionPolicy is actually set?

amazon-cloudformation amazon-web-services amazon-s3
1 Answers

I think the linked article (from 1/12/2014) is outdated. I just did the following:

Deployed a stack containing

MyBucket:
    Type: AWS::S3::Bucket
    .
    .
    .

Verified it deployed successfully, then deployed

MyBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    .
    .
    .

Verified it deployed successfully, then deleted my stack, and verified MyBucket is still present in S3.

user_78595150
Related