bucket/delete FormID 20501
Delete an S3 bucket. The bucket must be empty unless verifyEmpty is disabled.
Irreversible Operation: Deleting a bucket is permanent and cannot be undone. All versioned objects and delete markers are also removed. Confirm the bucket name via expression before execution and consider adding a manual approval node for production environments.
When to Use
- CI/CD cleanup: Clean up ephemeral test environment buckets after CI pipeline runs to avoid orphaned resources and unnecessary cost.
- Tenant offboarding: Decommission a tenant's dedicated storage bucket after confirming all data exports have completed.
- Temporary workflow buckets: Remove intermediate import/export buckets after a data migration or ETL workflow has finished processing.
Configuration
Connection
Credentials and region are not fields on this operation. Wire an S3 Server satellite node into this node's input. The satellite holds the vault credential (
ApiKey type — Username = access key ID, Password = secret key), the target AWS region, and an optional Service URL override for S3-compatible backends. Its values are merged onto this node at execution time and take precedence over anything set locally. See S3 Server (satellite) for the full field reference.
Operation Fields
| Field | Required | Description |
|---|---|---|
bucketName | Required | Name of the bucket to delete. Must match exactly — use an expression from a prior node output to avoid typos. |
verifyEmpty | Optional | When true (default), the operation fails with BucketNotEmpty if the bucket contains objects. Set to false only if a preceding workflow step has already emptied the bucket. |
Sample Configuration
// Credentials + region resolved from the connected S3 Server satellite — see s3-server-satellite.html
{
"resource": "bucket",
"operation": "delete",
"bucketName": "{{ $node.OffboardTenant.output.storageBucketName }}",
"verifyEmpty": true
}Validation Errors
| Error Code | Cause & Resolution |
|---|---|
BucketNotEmpty | The bucket still contains objects. Use folder/delete or object/delete nodes to empty the bucket first, then retry deletion. |
NoSuchBucket | The specified bucket does not exist. Check the bucket name expression and region. Consider handling gracefully in idempotent workflows. |
AccessDenied | The IAM identity lacks s3:DeleteBucket permission. Update the IAM policy and ensure the identity is the bucket owner. |
Output
Success Port
| Field | Type | Description |
|---|---|---|
status | string | success on successful deletion. |
errorCode | string | Empty string on success. |
bucketName | string | The name of the deleted bucket (for audit logging downstream). |
Error Port
On failure, activates with errorCode (BucketNotEmpty, NoSuchBucket, or AccessDenied), errorMessage, and httpStatusCode. Route NoSuchBucket to a continue path in idempotent decommissioning workflows.
Sample Output
{
"status": "success",
"errorCode": "",
"bucketName": "acme-tenant-northstar-docs"
}Expression Reference
| Expression | Result |
|---|---|
{{ $node.DeleteBucket.output.status }} | Confirm deletion succeeded before updating tenant records. |
{{ $node.DeleteBucket.output.bucketName }} | Log the deleted bucket name to audit trail or notification message. |
{{ $node.DeleteBucket.output.errorCode }} | Check for NoSuchBucket to handle idempotent re-runs gracefully. |
Node Policies & GuardRails
| Policy Area | Recommendation |
|---|---|
| Credential Storage | Store credentials in BizFirst Credentials Manager. Never hardcode accessKeyId or secretKey. |
| IAM Permissions | Grant only s3:DeleteBucket scoped to the specific bucket ARN. Never grant wildcard delete permissions. |
| Pre-deletion Verification | Always precede this node with a workflow step that confirms the correct bucket name and checks business rules (e.g. offboarding confirmed, data exported). |
| Empty Before Delete | Keep verifyEmpty: true. Use folder/delete to empty the bucket in a prior step if automated emptying is required. |
| Approval Gate | For production bucket deletions, insert a manual approval node before this node to require human confirmation. |
| Idempotent Error Handling | Route NoSuchBucket errors to a continue path — re-running a decommission workflow should not fail if the bucket was already deleted. |
| Audit Logging | Log bucketName and execution timestamp to the workflow audit trail immediately after successful deletion. |
| Versioning Consideration | If the bucket has versioning enabled, ensure all object versions and delete markers are purged before attempting bucket deletion. |
Examples
Example 1: Tenant Offboarding — Decommission Storage
After confirming data export is complete, delete the tenant's S3 bucket as the final offboarding step.
// Node: ConfirmDataExport (S3 — bucket/search) — verifies bucket is empty
// Node: DeleteTenantBucket (S3 — bucket/delete)
{
"bucketName": "{{ $node.GetTenantRecord.output.storageBucket }}",
"verifyEmpty": true
}
// Next: UpdateTenantStatus → SetStatus("offboarded")Example 2: CI Pipeline Cleanup
After a successful integration test run, a cleanup step removes the ephemeral test bucket created at pipeline start.
// Node: CleanupTestBucket (S3 — bucket/delete)
{
"bucketName": "ci-test-{{ $node.PipelineStart.output.runId }}",
"verifyEmpty": false // emptied by prior EmptyTestBucket node
}
// Error route: NoSuchBucket → Continue (idempotent)Example 3: Temporary Import Bucket Teardown
After an ETL migration workflow completes processing, the temporary staging bucket is removed.
// Node: RemoveStagingBucket (S3 — bucket/delete)
{
"bucketName": "{{ $env.ETL_STAGING_BUCKET }}",
"verifyEmpty": true
}
// On success: NotifyOpsTeam("Staging bucket removed: " + bucketName)