custom-resource-handlers/aws-s3/auto-delete-objects-handler: Object locked objects prevent cdk destroy

[aaronmills1]

Describe the bug

When an s3 bucket is created with object lock governance and the s3 bucket is set for removal cdk destroy fails. This happens even when the role has permissions to bypassgovernancelock

This is because in the auto-delete-objects-handler the s3 delete objects is called without BypassGovernanceRetention

Current: await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records } });

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

I expect for the cdk destroy to remove the governed objects provided the role has the necessary permissions

Current Behavior

The cdk destroy fails and the stack reverts back to its previous state

Reproduction Steps

    import * as s3 from 'aws-cdk-lib/aws-s3'
    import * as cdk from 'aws-cdk-lib'
    new s3.Bucket(scope, 'testID', {
          autoDeleteObjects: true,
          removalPolicy: cdk.RemovalPolicy.DESTROY,
          versioned: true,
          objectLockDefaultRetention: s3.ObjectLockRetention.governance(
            cdk.Duration.days(7)
          )
        })

Add some objects, then run cdk destroy

Possible Solution

await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records }, BypassGovernanceRetention: true });

The above will work for governed objects however will fail for non object locked objects. For this reason a combination of the two will need to be used

Additional Information/Context

No response

CDK CLI Version

2.160.0 (build 7a8ae02)

Framework Version

No response

Node.js Version

v21.7.1

OS

MacOS 14.7.1

Language

TypeScript

Language Version

No response

Other information

No response