In looking at the S3 console and docs, it seems that there’s a way to define a lifecycle policy that deletes all non-current versions of an object older than N day, but keeping at least K non-current versions. I can’t seem to find a way to do this in Pulumi though - am I missing something?

You can use s3control in the AWS classic provider: https://www.pulumi.com/registry/packages/aws/api-docs/s3control/bucketlifecycleconfiguration/

@little-cartoon-10569 this doesn’t seem to have it either: https://www.pulumi.com/registry/packages/aws/api-docs/s3control/bucketlifecycleconfiguration/#bucketlifecycleconfigurationruleexpiration

If you want versioning, just set the

versioning

property to

true

on the bucket. Then you can use

lifecycleRules

to control the lifecycle. https://www.pulumi.com/registry/packages/aws/api-docs/s3/bucket/#versioning_nodejs https://www.pulumi.com/registry/packages/aws/api-docs/s3/bucket/#lifecyclerules_nodejs

@little-cartoon-10569 I don’t think this resolves the original question. We have versioning enabled on the bucket (using Pulumi) and lifecycle rules (using Pulumi), but it looks like this specific capability (of being able to control the expiration date of non-current objects and set a minimum number of non-current versions to keep) is available in either Terraform or Pulumi. I can express this lifecycle policy in the AWS console (or API), just not in IAC at the moment.

This is my default setup:

lifecycleRules: [{
        enabled: true,
        noncurrentVersionExpiration: {
          days: 364,
        },
        noncurrentVersionTransitions: [
        {
          days: 29,
          storageClass: "GLACIER"
        }
      ]
      }

All good 🙂 We have a similar policy to yours:

&s3.BucketLifecycleRuleArgs{
				Enabled: pulumi.Bool(true),
				Id:      pulumi.String("audit"),
				Prefix:  pulumi.String(fmt.Sprintf("%s/", tenant.TENANT_AUDIT_LOGS_PREFIX)),
				NoncurrentVersionExpiration: &s3.BucketLifecycleRuleNoncurrentVersionExpirationArgs{
					Days: <http://pulumi.Int|pulumi.Int>(1),
				},
			},

If it's important in the short term, it should be feasible to use the AWS SDK to update the lifecycle rules after the Pulumi program finishes..

I can handle it for now, so it’s OK. The main issue with that approach is that I now need to have something else besides Pulumi (or use the automation API), which I’m trying to avoid. But it’s a good suggestion overall, so thank you.