Custom CDK resource to auto-delete S3 objects

[patchwork01]

Background

In an AWS account with locked down permissions, the CDK feature to auto-delete objects in an S3 bucket may not always work, see the following issue:

• (@aws-cdk/aws-s3): Use pre-defined role for autoDeleteObjects aws/aws-cdk#17198

Description

We'd like to replace our use of the CDK's autoDeleteObjects feature with a custom CDK resource implementation with the correct permissions for the bucket.

Analysis

This should be similar to our custom resources for the VPC check and saving instance properties, in VpcStack and PropertiesStack. These use lambdas implemented in the cdk-custom-resources module.

If we link the lambda to the bucket it needs to be able to delete from, that should set up the dependency between the resources to ensure the object deletion happens before the bucket is deleted.