s3-cleanup

Delete S3 objects older than N days from a bucket prefix. Daily summary of bytes freed. Dry-run mode for the first few runs so you can preview without accidentally nuking anything.

Use case

S3 buckets accumulate. Build artifacts, log dumps, temp files, expired exports — they sit there forever and quietly cost money. S3 Lifecycle Policies handle this in theory, but they're a pain to author for one-off cases and they apply silently with no notification. This workflow runs daily, deletes by age, and emails you a one-line summary so you know it ran and what it cleaned.

This is a YAML workflow, not a skill — pure plumbing, no AI value.

Setup

1. Create an aws credential with s3:ListBucket, s3:DeleteObject, and s3:GetObject on the target bucket
2. Edit workflow.yaml: - BUCKET — your bucket name (no s3:// prefix) - PREFIX — path inside the bucket (trailing slash matters; empty string = whole bucket) - RETENTION_DAYS — anything older than this gets deleted - DRY_RUN — 1 for first runs (preview only), then flip to 0 once you trust it
3. Schedule daily (or weekly for low-churn buckets)

Pipeline

1. cleanup — runtimeenv (bash + AWS CLI) — lists, filters by LastModified, deletes (or previews)
2. notify — message — sends the summary

Safety notes

• Always start with DRY_RUN=1 for at least one run, ideally a week. Verify the WOULD DELETE list matches your expectations
• The CLI uses your credential's IAM permissions — scope the policy tight (s3:DeleteObject only on the specific bucket+prefix)
• If you accidentally delete the wrong objects and the bucket has versioning, recovery is aws s3api restore-object — confirm versioning is enabled before relying on it as a safety net
• This workflow does NOT delete object versions or delete markers — for full purge of a versioned bucket, you need a different cleanup pattern

Customization

• Multiple prefixes — duplicate the cleanup task per prefix
• Per-prefix retention — different RETENTION_DAYS per task
• Pattern filter — add a --query clause that filters on Key as well as LastModified, e.g. Contents[?LastModified<=\...` && contains(Key, '.tmp')]`
• Cross-account — assume a role first via aws sts assume-role in the script

Source

See workflow.yaml.