S3 Object Expiry Notification Stack

S3 Object Expiry Notification Stack

A CloudFormation stack that combines S3 lifecycle expiry rules with a full audit trail of every object deletion. EventBridge captures S3 lifecycle expiry events, a Lambda function processes them, and every deletion is logged to DynamoDB with timestamp, bucket, key, size, and the lifecycle rule that triggered it.

What's Included

• S3 Bucket with Lifecycle Rules — configurable expiry rules by prefix and object age
• EventBridge Rule — captures Object Lifecycle Expiration events from S3 and routes them to Lambda
• Lambda Function — processes expiry events and writes structured records to DynamoDB
• DynamoDB Audit Table — stores deletion records with TTL so the audit log itself expires after a configurable retention period
• CloudWatch Log Group — Lambda logs retained separately for debugging
• IAM Roles — least-privilege roles for Lambda; EventBridge permission to invoke Lambda

What You Get

• s3-expiry-notification.yml — complete CloudFormation template
• lambda/handler.py — Lambda source included inline and as a separate file
• README.md — deploy instructions, parameter reference, and example DynamoDB queries for the audit log

Requirements

AWS CLI configured and IAM permissions to create S3, EventBridge, Lambda, DynamoDB, and CloudWatch resources. The stack creates all required resources — no pre-existing infrastructure needed beyond the AWS account.