diff --git a/test/s3/retention/object_lock_validation_test.go b/test/s3/retention/object_lock_validation_test.go index 4293486e8..3633e6c24 100644 --- a/test/s3/retention/object_lock_validation_test.go +++ b/test/s3/retention/object_lock_validation_test.go @@ -77,14 +77,14 @@ func TestObjectLockValidation(t *testing.T) { require.NoError(t, err, "Setting Object Lock retention should succeed") t.Log(" Object Lock retention applied successfully") - // Verify retention allows simple DELETE (creates delete marker) but blocks version deletion - // AWS S3 behavior: Simple DELETE (without version ID) is ALWAYS allowed and creates delete marker + // Verify retention blocks simple DELETE (COMPLIANCE mode is strict WORM) + // AWS S3 behavior: Simple DELETE (without version ID) is blocked by COMPLIANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker (AWS S3 behavior)") - t.Log(" Simple DELETE succeeded (creates delete marker - correct AWS behavior)") + require.Error(t, err, "Simple DELETE should be blocked by COMPLIANCE retention (AWS S3 behavior)") + t.Log(" Simple DELETE correctly blocked by COMPLIANCE retention") // Now verify that DELETE with version ID is properly blocked by retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ diff --git a/test/s3/retention/s3_retention_test.go b/test/s3/retention/s3_retention_test.go index 4abdf6d87..fc606030e 100644 --- a/test/s3/retention/s3_retention_test.go +++ b/test/s3/retention/s3_retention_test.go @@ -329,12 +329,12 @@ func TestRetentionModeCompliance(t *testing.T) { require.NoError(t, err) assert.Equal(t, types.ObjectLockRetentionModeCompliance, retentionResp.Retention.Mode) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail for COMPLIANCE mode (strict WORM) _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by COMPLIANCE retention") // Try DELETE with version ID - should fail for COMPLIANCE mode _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -388,12 +388,12 @@ func TestLegalHoldWorkflow(t *testing.T) { require.NoError(t, err) assert.Equal(t, types.ObjectLockLegalHoldStatusOn, legalHoldResp.LegalHold.Status) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to legal hold _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by legal hold") // Try DELETE with version ID - should fail due to legal hold _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -591,12 +591,12 @@ func TestRetentionAndLegalHoldCombination(t *testing.T) { }) require.NoError(t, err) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to legal hold + COMPLIANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by legal hold") // Try DELETE with version ID and bypass - should still fail due to legal hold _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -607,7 +607,7 @@ func TestRetentionAndLegalHoldCombination(t *testing.T) { }) require.Error(t, err, "Legal hold should prevent deletion even with governance bypass") - // Remove legal hold (must specify version ID since latest version is now delete marker) + // Remove legal hold (must specify version ID) _, err = client.PutObjectLegalHold(context.TODO(), &s3.PutObjectLegalHoldInput{ Bucket: aws.String(bucketName), Key: aws.String(key), diff --git a/test/s3/retention/s3_worm_integration_test.go b/test/s3/retention/s3_worm_integration_test.go index 19010092c..6dc0fda22 100644 --- a/test/s3/retention/s3_worm_integration_test.go +++ b/test/s3/retention/s3_worm_integration_test.go @@ -42,12 +42,12 @@ func TestWORMRetentionIntegration(t *testing.T) { }) require.NoError(t, err) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by GOVERNANCE retention") // Try DELETE with version ID - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ @@ -325,12 +325,12 @@ func TestRetentionWithMultipartUpload(t *testing.T) { }) require.NoError(t, err) - // Try simple DELETE - should succeed and create delete marker (AWS S3 behavior) + // Try simple DELETE - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{ Bucket: aws.String(bucketName), Key: aws.String(key), }) - require.NoError(t, err, "Simple DELETE should succeed and create delete marker") + require.Error(t, err, "Simple DELETE should be blocked by GOVERNANCE retention") // Try DELETE with version ID - should fail due to GOVERNANCE retention _, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{