aws_s3: Bucket with removal policy = retain lose resource policy on cdk destroy

[danilodesolesonar]

Describe the bug

Consider the following CDK app having a bucket that has enforce_ssl=True and removal_policy=Retain. On cdk destroy the bucket is retained, as expected, though the bucket resource policy is deleted.

from aws_cdk import Stack, RemovalPolicy
from constructs import Construct

from aws_cdk import aws_s3 as s3

class CdkS3BugStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        s3.Bucket(
            self,
            "RetainBucketTest",
            enforce_ssl=True,
            removal_policy=RemovalPolicy.RETAIN
        )

Expected Behavior

The bucket's resource policy is retained as well

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::cdks3bugstack-retainbuckettestef48b7bf-ms4g1j3j8dy6",
                "arn:aws:s3:::cdks3bugstack-retainbuckettestef48b7bf-ms4g1j3j8dy6/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

Current Behavior

The bucket is retained, its resource policy is not.

Reproduction Steps

Deploy the abovementioned app cdk deploy
Check the bucket resource policy, should contain the policy to disable non-SSL transport
Destroy the app cdk destroy
Check the bucket is still there, the policy is gone

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.93.0 (build 724bd01)

Framework Version

No response

Node.js Version

v18.14.2

OS

Fedora 36

Language

Python

Language Version

No response

Other information

No response

[khushail]

Hi @danilodesolesonar ,thanks for reaching out. Referencing the Deletion policy for resources along with S3 docs, I could confirm that the bucket policy is deleted from the console when removalPolicy is set to RETAIN. I am marking this as P2.