diff options
| -rw-r--r-- | test/s3/retention/object_lock_validation_test.go | 16 | ||||
| -rw-r--r-- | test/s3/retention/s3_worm_integration_test.go | 12 |
2 files changed, 23 insertions, 5 deletions
diff --git a/test/s3/retention/object_lock_validation_test.go b/test/s3/retention/object_lock_validation_test.go index f13d093ca..6224c7f67 100644 --- a/test/s3/retention/object_lock_validation_test.go +++ b/test/s3/retention/object_lock_validation_test.go @@ -77,13 +77,23 @@ func TestObjectLockValidation(t *testing.T) { require.NoError(t, err, "Setting Object Lock retention should succeed") t.Log(" ✅ Object Lock retention applied successfully") - // Verify retention is in effect + // Verify retention allows simple DELETE (creates delete marker) but blocks version deletion + // AWS S3 behavior: Simple DELETE (without version ID) is ALWAYS allowed and creates delete marker _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.Error(t, err, "Object should be protected by retention and cannot be deleted") - t.Log(" ✅ Object is properly protected by retention policy") + require.NoError(t, err, "Simple DELETE should succeed and create delete marker (AWS S3 behavior)") + t.Log(" ✅ Simple DELETE succeeded (creates delete marker - correct AWS behavior)") + + // Now verify that DELETE with version ID is properly blocked by retention + _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ + Bucket: aws.String(bucketName), + Key: aws.String(key), + VersionId: putResp.VersionId, + }) + require.Error(t, err, "DELETE with version ID should be blocked by COMPLIANCE retention") + t.Log(" ✅ Object version is properly protected by retention policy") // Verify we can read the object (should still work) getResp, err := client.GetObject(context.TODO(), &s3.GetObjectInput{ diff --git a/test/s3/retention/s3_worm_integration_test.go b/test/s3/retention/s3_worm_integration_test.go index e43510751..f6a81a49e 100644 --- a/test/s3/retention/s3_worm_integration_test.go +++ b/test/s3/retention/s3_worm_integration_test.go @@ -316,12 +316,20 @@ func TestRetentionWithMultipartUpload(t *testing.T) { }) require.NoError(t, err) - // Try to delete - should fail + // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.Error(t, err) + require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + + // Try DELETE with version ID - should fail due to GOVERNANCE retention + _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ + Bucket: aws.String(bucketName), + Key: aws.String(key), + VersionId: completeResp.VersionId, + }) + require.Error(t, err, "DELETE with version ID should be blocked by GOVERNANCE retention") } // TestRetentionExtendedAttributes tests that retention uses extended attributes correctly |