S3 general purpose buckets should have Lifecycle configurations

How to fix it

Add at least one enabled lifecycle rule to the bucket. Aborting incomplete multipart uploads after a few days is the one worth adding first: those parts are billed as storage and never appear in the object list. An expiration is a permanent delete and acts on objects already there. The CLI and Terraform routes replace the bucket's whole lifecycle configuration, so include the rules it already has, disabled ones too. A bucket with a lifecycle configuration cannot use MFA delete.

In the console

S3 → the bucket → Management → Lifecycle rules

With the AWS CLI

aws s3api put-bucket-lifecycle-configuration --bucket <bucket-name> --lifecycle-configuration file://lifecycle.json

With Terraform

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = var.bucket_name

  rule {
    id     = "abort-incomplete-multipart-uploads"
    status = "Enabled"

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}