amadan
infra: expire noncurrent control/geoip/ versions after a day (geoip spec §15)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+24
−0
infra/modules/deployment-buckets/main.tf+24 −0
diff --git a/infra/modules/deployment-buckets/main.tf b/infra/modules/deployment-buckets/main.tf| index 1d9991173..67bf51182 100644 |
| --- a/infra/modules/deployment-buckets/main.tf |
| +++ b/infra/modules/deployment-buckets/main.tf |
| @@ -25,6 +25,30 @@ resource "aws_s3_bucket_versioning" "deployment" { |
| versioning_configuration { status = "Enabled" } |
| } |
| +# GeoIP databases (platform geoip spec 2026-10-06 §15 step 0, D1): a deleted |
| +# or superseded blob under control/geoip/ must not live on as a noncurrent |
| +# version, because MaxMind's GeoLite EULA requires destroying superseded |
| +# editions. Scoped to that prefix only; nothing else in this bucket expires. |
| +resource "aws_s3_bucket_lifecycle_configuration" "deployment" { |
| + bucket = aws_s3_bucket.deployment.id |
| + |
| + rule { |
| + id = "geoip-noncurrent" |
| + status = "Enabled" |
| + filter { |
| + prefix = "control/geoip/" |
| + } |
| + noncurrent_version_expiration { |
| + noncurrent_days = 1 |
| + } |
| + abort_incomplete_multipart_upload { |
| + days_after_initiation = 1 |
| + } |
| + } |
| + |
| + depends_on = [aws_s3_bucket_versioning.deployment] |
| +} |
| + |
| resource "aws_s3_bucket_versioning" "data" { |
| bucket = aws_s3_bucket.data.id |
| versioning_configuration { status = "Enabled" } |