S3 DeleteBucket Object Lock Compliance Monitor

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15–45 mins depending on retention mode

TL;DR

• What broke: s3:DeleteBucket is hard-blocked because the bucket has S3 Object Lock active — either objects are under a Compliance-mode retention period, the bucket still contains locked objects, or the IAM principal lacks s3:BypassGovernanceRetention.
• How to fix it: Identify the lock mode (Governance vs. Compliance), purge all object versions and delete markers after retention expires or with bypass, then delete the empty bucket using a principal with the correct permissions.
• Shortcut: Use our Client-Side Sandbox above to auto-refactor your IAM policy or Terraform config — your ARNs never leave your browser.

An error occurred (AccessDenied) when calling the DeleteBucket operation:
Access Denied

botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling
the DeleteBucket operation: Access Denied

How to Fix It (The Solution)

Step 0: Diagnose the Lock Mode First

# Check bucket-level Object Lock configuration
aws s3api get-object-lock-configuration --bucket YOUR_BUCKET_NAME

# Check a specific object version's retention
aws s3api get-object-retention \
  --bucket YOUR_BUCKET_NAME \
  --key YOUR_OBJECT_KEY \
  --version-id YOUR_VERSION_ID

If the mode is COMPLIANCE and RetainUntilDate is in the future: stop here. You cannot delete these objects until the date passes. Contact your compliance team.

If the mode is GOVERNANCE: proceed to the fix below.

Basic Fix — Governance Mode: Delete with Bypass

You need the s3:BypassGovernanceRetention permission AND must pass the x-amz-bypass-governance-retention: true header.

Step 1: Grant the permission to your IAM principal

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
-       "s3:DeleteObject",
-       "s3:DeleteObjectVersion",
-       "s3:DeleteBucket"
+       "s3:DeleteObject",
+       "s3:DeleteObjectVersion",
+       "s3:DeleteBucket",
+       "s3:BypassGovernanceRetention",
+       "s3:ListBucketVersions",
+       "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ]
    }
  ]
}

Step 2: Delete all object versions and delete markers, then the bucket

# Delete all object versions with bypass header
aws s3api list-object-versions --bucket YOUR_BUCKET_NAME \
  --query 'Versions[].{Key:Key,VersionId:VersionId}' \
  --output text | while read KEY VERSIONID; do
    aws s3api delete-object \
      --bucket YOUR_BUCKET_NAME \
      --key "$KEY" \
      --version-id "$VERSIONID" \
      --bypass-governance-retention
done

# Delete all delete markers
aws s3api list-object-versions --bucket YOUR_BUCKET_NAME \
  --query 'DeleteMarkers[].{Key:Key,VersionId:VersionId}' \
  --output text | while read KEY VERSIONID; do
    aws s3api delete-object \
      --bucket YOUR_BUCKET_NAME \
      --key "$KEY" \
      --version-id "$VERSIONID"
done

# Now delete the empty bucket
aws s3api delete-bucket --bucket YOUR_BUCKET_NAME

Enterprise Best Practice — Least Privilege with Condition Keys

Never grant s3:BypassGovernanceRetention broadly. Scope it to a break-glass role with MFA enforcement and CloudTrail alerting.

{
  "Version": "2012-10-17",
  "Statement": [
-   {
-     "Effect": "Allow",
-     "Principal": {"AWS": "arn:aws:iam::ACCOUNT_ID:role/DeployRole"},
-     "Action": "s3:*",
-     "Resource": "*"
-   }
+   {
+     "Sid": "AllowGovernanceBypassOnlyWithMFA",
+     "Effect": "Allow",
+     "Principal": {"AWS": "arn:aws:iam::ACCOUNT_ID:role/BreakGlassS3Role"},
+     "Action": [
+       "s3:BypassGovernanceRetention",
+       "s3:DeleteObjectVersion",
+       "s3:DeleteBucket"
+     ],
+     "Resource": [
+       "arn:aws:s3:::YOUR_BUCKET_NAME",
+       "arn:aws:s3:::YOUR_BUCKET_NAME/*"
+     ],
+     "Condition": {
+       "Bool": {
+         "aws:MultiFactorAuthPresent": "true"
+       },
+       "NumericLessThan": {
+         "aws:MultiFactorAuthAge": "3600"
+       }
+     }
+   }
  ]
}

Terraform equivalent for the break-glass role:

 resource "aws_iam_role_policy" "s3_object_lock_bypass" {
   name = "s3-object-lock-bypass"
   role = aws_iam_role.break_glass.id
 
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [{
       Effect = "Allow"
       Action = [
-        "s3:*"
+        "s3:BypassGovernanceRetention",
+        "s3:DeleteObjectVersion",
+        "s3:DeleteBucket",
+        "s3:ListBucketVersions",
+        "s3:ListBucket"
       ]
-      Resource = "*"
+      Resource = [
+        "arn:aws:s3:::${var.bucket_name}",
+        "arn:aws:s3:::${var.bucket_name}/*"
+      ]
+      Condition = {
+        Bool = {
+          "aws:MultiFactorAuthPresent" = "true"
+        }
+      }
     }]
   })
 }

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .checkov.yml
checks:
  - CKV_AWS_145   # Ensure S3 bucket has versioning enabled
  - CKV2_AWS_61   # Ensure S3 bucket has MFA delete enabled
  - CKV_AWS_372   # Custom: Block s3:* wildcard on Object Lock buckets

package terraform.s3_object_lock

deny[msg] {
  resource := input.resource.aws_iam_role_policy[_]
  policy := json.unmarshal(resource.policy)
  statement := policy.Statement[_]
  statement.Effect == "Allow"
  statement.Action == "s3:*"
  msg := sprintf(
    "IAM policy '%v' grants s3:* wildcard — forbidden on Object Lock buckets. Scope to explicit actions.",
    [resource]
  )
}

deny[msg] {
  resource := input.resource.aws_s3_bucket_object_lock_configuration[_]
  resource.rule.default_retention.mode == "COMPLIANCE"
  days := resource.rule.default_retention.days
  days > 3650
  msg := sprintf(
    "Compliance retention of %v days exceeds 10 years. Verify this is intentional — it cannot be reduced.",
    [days]
  )
}

- name: Validate S3 Object Lock retention sanity
  run: |
    LOCK_CONFIG=$(aws s3api get-object-lock-configuration \
      --bucket ${{ env.BUCKET_NAME }} 2>/dev/null || echo "NONE")
    if echo "$LOCK_CONFIG" | grep -q '"Mode": "COMPLIANCE"'; then
      echo "::warning::COMPLIANCE mode Object Lock detected on ${{ env.BUCKET_NAME }}. Destroy will require retention expiry."
      exit 1
    fi

{
  "source": ["aws.s3"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventName": ["DeleteObject", "DeleteObjectVersion"],
    "requestParameters": {
      "x-amz-bypass-governance-retention": ["true"]
    }
  }
}