cloud custodian policy / lambda to add lifecycle rule on bucket delete attempts

add-lifecycle-policy-on-bucket-delete.yaml

policies:
  - name: add-lifecycle-policy-on-bucket-delete
    comments: |
      In dev, let's start emptying the bucket as soon as delete is requested so that we can have a more ephmeral environment for standup/teardown
    resource: s3
    mode:
      type: cloudtrail
      role: cloud-custodian-role
      execution-options:
        log_group: cloud-custodian
      events:
        - source: s3.amazonaws.com
          event: DeleteBucket
          ids: 'requestParameters.bucketName'
      # Default behavior bails early due to the error code of BucketNotEmpty being present.
      # This took forever to figure out. Never spend time on this.
      environment:
        Variables:
          C7N_SKIP_ERR_EVENT: 'no'
    # Only put policy on buckets that have the env = dev tag for safety
    filters:
      - tag:env: dev
    actions:
      - type: configure-lifecycle
        rules:
          - ID: empty-bucket
            Status: Enabled
            Filter:
              Prefix: ''
            Expiration:
              Days: 1
            NoncurrentVersionExpiration:
              NoncurrentDays: 1