18

It looks like creating a bucket policy might do the trick, but I am having trouble creating the policy.

3 Answers 3

30

The AWS Policy Generator is a very helpful tool for the exploration and creation of such policies, its usage is explained in the respective introductory blog post (a direct link to it it is meanwhile available alongside most policy entry forms within the AWS Management Console as well).

I've created an example according to your specification (make sure to generate a new one for your own resources of course):

{
  "Id": "ExamplePolicyId12345678",
  "Statement": [
    {
      "Sid": "ExampleStmtSid12345678",
      "Action": [
        "s3:DeleteBucket"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::test-example-com",
      "Principal": {
        "AWS": [
          "*"
        ]
      }
    }
  ]
}

Please note that the AWS Management Console currently neither hides the delete command nor reports on its execution being unsuccessful for buckets with such policies, however, the bucket remains in place ;)

6
  • Can you still delete the bucket through logging into the AWS Control Panel? Jan 7, 2016 at 20:01
  • Great thanks. I've just applied this to one of my buckets that I don't want to be accidentally deleted. Not that I particularly want to test a delete on my live bucket though ;)
    – Chris
    Jun 19, 2019 at 16:07
  • The documentation specifies : When you specify users in a Principal element, you cannot use a wildcard (*) to mean "all users". Principals must always name a specific user or users. docs.aws.amazon.com/IAM/latest/UserGuide/… Nov 26, 2019 at 21:13
  • Sorry for my previous comment. It seems to be working great :) Nov 26, 2019 at 21:49
  • In case anyone like me needs clarity - this policy is applied on the individual S3 bucket that you want to make hard to delete. Once applied, delete requests from any user (including root) are denied. Great way to prevent accidental delete.
    – F_SO_K
    Apr 30, 2020 at 18:19
11

So @Steffen's answer is right but I wanted to put another important note. While the policy will protect against the actual bucket being deleted. It won't protect against the items in the bucket being deleted. Which makes sense, but what you should be aware of is that in the AWS console if you choose delete bucket, it will remove all the items in the bucket, then fail to delete the bucket. So any data you had in the bucket will go away. This isn't obvious at first, and could cause serious issues for someone if they're not aware.

TL;DR; Trying to delete the bucket even with delete bucket prohibited will kill all the items in the bucket but keep the bucket around

2

Another option is to enable Versioning and MFA Delete. This makes it harder to empty and delete a bucket.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .