fix(aws/s3): link inline lifecycle/ITC/versioning configs to nameless buckets [FIX-304] - #71
Merged
Merged
Conversation
… buckets CloudFormation/CDK S3 buckets usually have no explicit BucketName (the physical name is generated at deploy time). Their inline configurations therefore carry an empty bucket name, so the bucket<->config join in PostProcess (keyed only on the referenced bucket name) dropped them. Buckets ended up with no Relationships.LifecycleConfigurations, causing the S3 lifecycle FinOps policies (delete-multipart-uploads, ensure-transition-rules) to report false failures. Inline configs share the owning bucket's logical ID, which is already indexed in bucketMap, so fall back to matching on the sub-resource's own ID when the bucket name doesn't match. Standalone resources have distinct IDs and so never false-match.
liamg
approved these changes
Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FIX-304
CloudFormation/CDK
AWS::S3::Bucketresources with an inlineLifecycleConfigurationbut no explicitBucketName(the CDK default — the physical name is generated at deploy time) falsely fail the S3 lifecycle FinOps policies (aws-delete-multi-part-uploads-s3-lifecycle-configuration,aws-ensure-transition-rules-defined-s3-lifecycle-configuration).Root cause
pkg/tree/aws/s3/s3.goPostProcess()joins lifecycle/ITC/versioning/policy configs to buckets viabucketMap, keyed on bucket name (skipped when empty) and bucket ID. Inline CFN configs carry an emptyBucketName, so the join misses and the bucket ends up with zeroRelationships.LifecycleConfigurations— the policies only iterate that relationship, so they report false failures.Confirmed against the real parsed tree: a nameless bucket's inline lifecycle config has
bucketName=""butid == "<bucket logical ID>"(identical to the bucket). That ID is already inbucketMap, it just wasn't consulted for the join.Regression from the IaC-agnostic tree refactor (providers #74 / #90); pre-refactor code attached inline CFN rules directly to
bucket.LifecycleRules, so no name join was needed.Fix
In
PostProcess(), fall back to matching a sub-resource by its ownIDwhen the bucket-name match misses. Inline configs share the owning bucket's logical ID; standalone resources (separate lifecycle config / bucket policy) have distinct IDs and so never false-match. Applied to lifecycle, intelligent-tiering, versioning, and bucket-policy joins.Tests
pkg/tree/aws/s3/s3_nameless_bucket_test.go— links inline configs to a nameless bucket by shared ID, and asserts a standalone config pointing at another bucket is not false-matched. Existing idempotency test still passes.Downstream
providersregression tests live in #(providers PR, see FIX-304). Once this is released, bumpgo-protoinproviders(go.mod+e2e/go.mod) to pick up the fix.