AWS AmazonS3 documentation change
Summary
Updated documentation for S3 bucket deletion process with: 1) Clarified bucket name uniqueness risks and deletion propagation time 2) Reorganized troubleshooting steps with explicit IAM permission checks 3) Added SDK examples link 4) Removed directory bucket references 5) Updated Java SDK version references
Security assessment
Changes emphasize security best practices (checking IAM permissions, SCP/RCP policies, and bucket policy Deny statements) but do not address a specific disclosed vulnerability. The updates improve clarity around access control requirements without indicating a security incident.
Diff
diff --git a/AmazonS3/latest/userguide/delete-bucket.md b/AmazonS3/latest/userguide/delete-bucket.md index 1567a569a..3cce087a7 100644 --- a/AmazonS3/latest/userguide/delete-bucket.md +++ b/AmazonS3/latest/userguide/delete-bucket.md @@ -15 +15,3 @@ Before deleting a bucket, consider the following: - * Bucket names are unique. If you delete a bucket, another AWS user can use the name for a new bucket, and potentially receive requests intended for the deleted bucket. If you want to prevent this, or if you want to continue to use the same bucket name, don't delete the bucket. We recommend that you empty the bucket and keep it, and instead, block any bucket requests as needed. + * Bucket names are unique within a global namespace. **If you delete a bucket, be aware that another AWS account can use the same bucket name for a new bucket and can therefore potentially receive requests intended for the deleted bucket.** If you want to prevent this, or if you want to continue to use the same bucket name, don't delete the bucket. We recommend that you empty the bucket and keep it, and instead, block any bucket requests as needed. For buckets no longer in active use, we recommend emptying the bucket of all objects to minimize costs while retaining the bucket itself. + + * When you delete a bucket, the bucket might not be instantly removed. Instead, Amazon S3 queues the bucket for deletion. Because Amazon S3 is distributed across AWS Regions, the deletion process takes time to fully propagate and achieve consistency throughout the system. @@ -32 +34 @@ If you are unable to delete an Amazon S3 bucket, consider the following: - * **AWS Organizations service control policies (SCPs) and resource control policies (RCPs)** – SCPs and RCPs can deny the delete permission on a bucket. For more information, see [service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) and [resource control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html) in the _AWS Organizations User Guide_. + * **Make sure that you have the`s3:DeleteBucket` permission** – If you can't delete a bucket, work with your IAM administrator to confirm that you have the `s3:DeleteBucket` permission. For information about how to view or update IAM permissions, see [Changing permissions for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html) in the _IAM User Guide_. For troubleshooting information, see [Troubleshoot access denied (403 Forbidden) errors in Amazon S3](./troubleshoot-403-errors.html). @@ -34 +36 @@ If you are unable to delete an Amazon S3 bucket, consider the following: - * **`s3:DeleteBucket` permissions** – If you cannot delete a bucket, work with your IAM administrator to confirm that you have `s3:DeleteBucket` permissions. For information about how to view or update IAM permissions, see [Changing permissions for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html) in the _IAM User Guide_. For troubleshooting information, see [Troubleshoot access denied (403 Forbidden) errors in Amazon S3](./troubleshoot-403-errors.html). + * **Check for`s3:DeleteBucket Deny` statements in AWS Organizations service control policies (SCPs) and resource control policies (RCPs)** – SCPs and RCPs can deny the delete permission on a bucket. For more information, see [service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) and [resource control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html) in the _AWS Organizations User Guide_. @@ -36 +38 @@ If you are unable to delete an Amazon S3 bucket, consider the following: - * **`s3:DeleteBucket Deny` statement** – If you have `s3:DeleteBucket` permissions in your IAM policy and you can't delete a bucket, the bucket policy might include a `Deny` statement for `s3:DeleteBucket`. Buckets created by AWS Elastic Beanstalk have a policy containing this statement by default. Before you can delete the bucket, you must delete this statement or the bucket policy. + * **Check for`s3:DeleteBucket Deny` statements in your bucket policy** – If you have `s3:DeleteBucket` permissions in your IAM user or role policy and you can't delete a bucket, the bucket policy might include a `Deny` statement for `s3:DeleteBucket`. Buckets created by AWS Elastic Beanstalk have a policy containing this statement by default. Before you can delete the bucket, you must delete this statement or the bucket policy. @@ -49 +51 @@ Before you can delete a bucket, you must empty it. For information about emptyin - 2. In the left navigation pane, choose **General purpose buckets** or **Directory buckets**. + 2. In the left navigation pane, choose **General purpose buckets**. @@ -64 +66,3 @@ If the bucket contains any objects, empty the bucket before deleting it by choos -The following example shows how to delete a bucket by using the AWS SDK for Java. The code first deletes all objects in the bucket, and then it deletes the bucket. For information about using other AWS SDKs, see [Tools for Amazon Web Services](https://aws.amazon.com/tools/). +The following example shows how to empty and delete a bucket by using the AWS SDK for Java. The code first deletes all objects in the bucket, and then it deletes the bucket. + +For examples in other languages, see [Use DeleteBucket with an AWS SDK or CLI](https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_DeleteBucket_section.html) in the _Amazon Simple Storage Service API Reference_. For information about using other AWS SDKs, see [Tools for Amazon Web Services](https://aws.amazon.com/tools/). @@ -75 +79 @@ For buckets without versioning enabled, you can delete all objects directly and -For instructions on creating and testing a working sample, see [Getting Started](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/getting-started.html) in the _AWS SDK for Java Developer Guide_. +For instructions on creating and testing a working sample, see the [AWS SDK for Java 2.x Developer Guide](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/home.html). @@ -160 +164 @@ You can delete a bucket that contains objects with the AWS CLI if the bucket doe -If your bucket doesn't have versioning enabled, you can use the `rb` (remove bucket) AWS CLI command with the `--force` parameter to delete the bucket and all the objects in it. This command deletes all objects first and then deletes the bucket. +If your bucket doesn't have versioning enabled, you can use the `rb` (remove bucket) AWS CLI command with the `--force` parameter to delete the bucket and all the objects in it. This command deletes all the objects first and then deletes the bucket.