S3 — folder/delete

Irreversible Bulk Deletion: This operation deletes ALL objects whose keys begin with the specified folderPath prefix. For unversioned buckets, this is permanent. Confirm the folderPath expression resolves to the intended prefix before execution. A misplaced prefix could delete thousands of objects.

S3 Folder Model: S3 has no native folders. folder/delete performs a prefix-based batch delete — listing all objects with the matching key prefix and deleting them in batches of up to maxObjectsToDelete per AWS DeleteObjects API call.

When to Use

Tenant offboarding: Remove the tenant's entire folder structure and all contained files during an offboarding workflow after data export is confirmed.
Post-ingestion cleanup: Delete the incoming upload folder after all files have been successfully processed and moved to a permanent destination.
Temp working folder purge: Remove a session-specific working directory at the end of a workflow to prevent accumulation of temporary processing files.
Expired archive partition: Delete a date-partitioned folder (e.g. archive/2023/) after its retention period has expired.

Configuration

Connection

Field	Required	Description
`accessKeyId`	Required	AWS Access Key ID. Store in BizFirst Credentials Manager.
`secretKey`	Required	AWS Secret Access Key. Never log or expose.
`sessionToken`	Optional	STS session token for temporary credentials.
`region`	Required	AWS region of the bucket.

Operation Fields

Field	Required	Description
`bucketName`	Required	Name of the bucket containing the folder to delete.
`folderPath`	Required	Prefix of objects to delete (e.g. `tenants/t1024/`). All objects whose keys start with this string are deleted. Use a trailing slash to scope to a folder; omitting it may match unintended keys.
`verifyEmpty`	Optional	When `true`, check the prefix is empty before deleting — useful for confirming prior cleanup steps completed. Default: `false`.
`maxObjectsToDelete`	Optional	Maximum number of objects to delete per batch. Default: `1000`. The node iterates through all pages until all matching objects are deleted.

Sample Configuration

{
  "connection": {
    "accessKeyId": "{{ $credentials.s3_ops.accessKeyId }}",
    "secretKey": "{{ $credentials.s3_ops.secretKey }}",
    "region": "us-east-1"
  },
  "operation": {
    "resource": "folder",
    "action": "delete",
    "bucketName": "acme-tenant-storage",
    "folderPath": "tenants/{{ $node.OffboardTenant.output.tenantId }}/",
    "verifyEmpty": false,
    "maxObjectsToDelete": 1000
  }
}

Validation Errors

Error Code	Cause & Resolution
`AccessDenied`	The IAM identity lacks `s3:DeleteObject` or `s3:ListBucket` on the target bucket. Both permissions are required for prefix-based batch deletion.
`NoSuchBucket`	The specified bucket does not exist. Verify the bucket name and consider handling gracefully in idempotent offboarding workflows.
`PrefixNotEmpty`	Only raised when `verifyEmpty: true` and objects are found. Used as a pre-flight safety check — address the remaining content and retry.

Output

Success Port

Field	Type	Description
`status`	string	`success` when all objects under the prefix have been deleted.
`errorCode`	string	Empty string on success.
`bucketName`	string	The bucket where objects were deleted.
`folderPath`	string	The prefix that was deleted.
`objectsRemoved`	int	Total number of objects deleted across all batch iterations.

Error Port

On failure, activates with errorCode, errorMessage, and httpStatusCode. Handle NoSuchBucket gracefully in decommission workflows where the bucket may have been deleted already.

Sample Output

{
  "status": "success",
  "errorCode": "",
  "bucketName": "acme-tenant-storage",
  "folderPath": "tenants/t1024/",
  "objectsRemoved": 342
}

Expression Reference

Expression	Result
`{{ $node.DeleteTenantFolder.output.objectsRemoved }}`	Total objects removed — log to offboarding audit record.
`{{ $node.DeleteTenantFolder.output.folderPath }}`	Confirm deleted prefix in audit trail or notification message.
`{{ $node.DeleteTenantFolder.output.bucketName }}`	Confirm target bucket in log entries.

Node Policies & GuardRails

Policy Area	Recommendation
Credential Storage	Store credentials in BizFirst Credentials Manager. Never hardcode.
IAM Permissions	Grant `s3:DeleteObject` and `s3:ListBucket` scoped to the target bucket ARN. Restrict further using condition keys if possible.
Prefix Validation	Always validate the `folderPath` expression before execution. A missing or truncated prefix could match and delete unintended objects.
Trailing Slash	Always include a trailing `/` in `folderPath` to scope deletion to a specific "folder" and prevent accidental prefix overlap.
Approval Gate	For tenant offboarding folder deletion, insert a Human-in-Loop Approval node requiring explicit confirmation before executing this operation.
Versioned Bucket Handling	For versioned buckets, prefix deletion creates delete markers rather than permanently removing data. Follow with a versioned delete sweep to permanently erase all versions.
Audit Logging	Log `objectsRemoved`, `folderPath`, and the executing user identity to a persistent audit store immediately after deletion completes.
Idempotency	If the prefix no longer contains any objects (already deleted), `objectsRemoved` will be 0 and the operation returns success — safe for idempotent re-runs.

Examples

Example 1: Tenant Offboarding Folder Cleanup

As part of tenant offboarding, delete all objects in the tenant's storage folder after confirming data export.

// Node: ConfirmDataExport (prior step verifies export completed)
// Node: ApprovalGate (Human-in-Loop — require sign-off)
// Node: DeleteTenantData (S3 — folder/delete)
{
  "bucketName": "acme-shared-storage",
  "folderPath": "tenants/{{ $node.OffboardRequest.output.tenantId }}/",
  "maxObjectsToDelete": 1000
}
// Node: LogDeletion → { tenantId, objectsRemoved, deletedAt }

Example 2: Post-Ingestion Landing Zone Cleanup

After all files in an incoming upload folder have been processed and verified, delete the entire landing zone prefix.

// Node: VerifyAllProcessed (If Condition — all items in loop processed)
// Node: CleanupLandingZone (S3 — folder/delete)
{
  "bucketName": "acme-ingest",
  "folderPath": "incoming/{{ $node.BatchJob.output.batchId }}/",
  "maxObjectsToDelete": 1000
}
// On success: mark batchId as completed in database

Example 3: Expired Archive Partition Removal

A monthly scheduled workflow removes archive partitions older than the configured retention period.

// Node: CalculateExpiredPartition (Code Execute)
// Returns: expiryPrefix = "archive/" + expiredYear + "/" + expiredMonth + "/"
// Node: DeleteExpiredPartition (S3 — folder/delete)
{
  "bucketName": "acme-long-term-archive",
  "folderPath": "{{ $node.CalculateExpiredPartition.output.expiryPrefix }}",
  "maxObjectsToDelete": 1000
}
// Log: objectsRemoved, folderPath, executionTimestamp

folder/delete FormID 20510

When to Use

Configuration

Connection

Operation Fields

Sample Configuration

Validation Errors

Output

Success Port

Error Port

Sample Output

Expression Reference

Node Policies & GuardRails

Examples

Example 1: Tenant Offboarding Folder Cleanup

Example 2: Post-Ingestion Landing Zone Cleanup

Example 3: Expired Archive Partition Removal