S3 — bucket/delete

Irreversible Operation: Deleting a bucket is permanent and cannot be undone. All versioned objects and delete markers are also removed. Confirm the bucket name via expression before execution and consider adding a manual approval node for production environments.

When to Use

CI/CD cleanup: Clean up ephemeral test environment buckets after CI pipeline runs to avoid orphaned resources and unnecessary cost.
Tenant offboarding: Decommission a tenant's dedicated storage bucket after confirming all data exports have completed.
Temporary workflow buckets: Remove intermediate import/export buckets after a data migration or ETL workflow has finished processing.

Configuration

Connection

Field	Required	Description
`accessKeyId`	Required	AWS Access Key ID. Store in BizFirst Credentials Manager.
`secretKey`	Required	AWS Secret Access Key. Never log or expose.
`sessionToken`	Optional	STS session token for temporary credentials.
`region`	Required	AWS region where the bucket resides.

Operation Fields

Field	Required	Description
`bucketName`	Required	Name of the bucket to delete. Must match exactly — use an expression from a prior node output to avoid typos.
`verifyEmpty`	Optional	When `true` (default), the operation fails with `BucketNotEmpty` if the bucket contains objects. Set to `false` only if a preceding workflow step has already emptied the bucket.

Sample Configuration

{
  "connection": {
    "accessKeyId": "{{ $credentials.s3_ops.accessKeyId }}",
    "secretKey": "{{ $credentials.s3_ops.secretKey }}",
    "region": "us-east-1"
  },
  "operation": {
    "resource": "bucket",
    "action": "delete",
    "bucketName": "{{ $node.OffboardTenant.output.storageBucketName }}",
    "verifyEmpty": true
  }
}

Validation Errors

Error Code	Cause & Resolution
`BucketNotEmpty`	The bucket still contains objects. Use `folder/delete` or `object/delete` nodes to empty the bucket first, then retry deletion.
`NoSuchBucket`	The specified bucket does not exist. Check the bucket name expression and region. Consider handling gracefully in idempotent workflows.
`AccessDenied`	The IAM identity lacks `s3:DeleteBucket` permission. Update the IAM policy and ensure the identity is the bucket owner.

Output

Success Port

Field	Type	Description
`status`	string	`success` on successful deletion.
`errorCode`	string	Empty string on success.
`bucketName`	string	The name of the deleted bucket (for audit logging downstream).

Error Port

On failure, activates with errorCode (BucketNotEmpty, NoSuchBucket, or AccessDenied), errorMessage, and httpStatusCode. Route NoSuchBucket to a continue path in idempotent decommissioning workflows.

Sample Output

{
  "status": "success",
  "errorCode": "",
  "bucketName": "acme-tenant-northstar-docs"
}

Expression Reference

Expression	Result
`{{ $node.DeleteBucket.output.status }}`	Confirm deletion succeeded before updating tenant records.
`{{ $node.DeleteBucket.output.bucketName }}`	Log the deleted bucket name to audit trail or notification message.
`{{ $node.DeleteBucket.output.errorCode }}`	Check for `NoSuchBucket` to handle idempotent re-runs gracefully.

Node Policies & GuardRails

Policy Area	Recommendation
Credential Storage	Store credentials in BizFirst Credentials Manager. Never hardcode `accessKeyId` or `secretKey`.
IAM Permissions	Grant only `s3:DeleteBucket` scoped to the specific bucket ARN. Never grant wildcard delete permissions.
Pre-deletion Verification	Always precede this node with a workflow step that confirms the correct bucket name and checks business rules (e.g. offboarding confirmed, data exported).
Empty Before Delete	Keep `verifyEmpty: true`. Use `folder/delete` to empty the bucket in a prior step if automated emptying is required.
Approval Gate	For production bucket deletions, insert a manual approval node before this node to require human confirmation.
Idempotent Error Handling	Route `NoSuchBucket` errors to a continue path — re-running a decommission workflow should not fail if the bucket was already deleted.
Audit Logging	Log `bucketName` and execution timestamp to the workflow audit trail immediately after successful deletion.
Versioning Consideration	If the bucket has versioning enabled, ensure all object versions and delete markers are purged before attempting bucket deletion.

Examples

Example 1: Tenant Offboarding — Decommission Storage

After confirming data export is complete, delete the tenant's S3 bucket as the final offboarding step.

// Node: ConfirmDataExport (S3 — bucket/search) — verifies bucket is empty
// Node: DeleteTenantBucket (S3 — bucket/delete)
{
  "bucketName": "{{ $node.GetTenantRecord.output.storageBucket }}",
  "verifyEmpty": true
}
// Next: UpdateTenantStatus → SetStatus("offboarded")

Example 2: CI Pipeline Cleanup

After a successful integration test run, a cleanup step removes the ephemeral test bucket created at pipeline start.

// Node: CleanupTestBucket (S3 — bucket/delete)
{
  "bucketName": "ci-test-{{ $node.PipelineStart.output.runId }}",
  "verifyEmpty": false  // emptied by prior EmptyTestBucket node
}
// Error route: NoSuchBucket → Continue (idempotent)

Example 3: Temporary Import Bucket Teardown

After an ETL migration workflow completes processing, the temporary staging bucket is removed.

// Node: RemoveStagingBucket (S3 — bucket/delete)
{
  "bucketName": "{{ $env.ETL_STAGING_BUCKET }}",
  "verifyEmpty": true
}
// On success: NotifyOpsTeam("Staging bucket removed: " + bucketName)

bucket/delete FormID 20501

When to Use

Configuration

Connection

Operation Fields

Sample Configuration

Validation Errors

Output

Success Port

Error Port

Sample Output

Expression Reference

Node Policies & GuardRails

Examples

Example 1: Tenant Offboarding — Decommission Storage

Example 2: CI Pipeline Cleanup

Example 3: Temporary Import Bucket Teardown