Three specific behaviors are currently untested at the synthesized-template level:
- HIGH tier retains data:
SecureBucket at HIGH should produce DeletionPolicy: Retain (and UpdateReplacePolicy: Retain) on the bucket resource — the "can't accidentally delete production data" guarantee.
- Injector intelligent-tiering default:
SecureBucketDefaults injects a default-tiering intelligent-tiering configuration (archive 90d / deep archive 180d) when the caller supplies none — no test asserts it appears in the template, nor that a caller-supplied configuration wins.
- LOW-tier tag: the
SecurityLevel: Low tag value on a LOW-tier bucket (HIGH's tag is covered; the lowercase-to-capitalized conversion path for other tiers is not).
Each is a small, independent template assertion — fine to land as one PR or three tiny ones.
Acceptance criteria
- All three behaviors are locked in by template assertions.
Three specific behaviors are currently untested at the synthesized-template level:
SecureBucketat HIGH should produceDeletionPolicy: Retain(andUpdateReplacePolicy: Retain) on the bucket resource — the "can't accidentally delete production data" guarantee.SecureBucketDefaultsinjects adefault-tieringintelligent-tiering configuration (archive 90d / deep archive 180d) when the caller supplies none — no test asserts it appears in the template, nor that a caller-supplied configuration wins.SecurityLevel: Lowtag value on a LOW-tier bucket (HIGH's tag is covered; the lowercase-to-capitalized conversion path for other tiers is not).Each is a small, independent template assertion — fine to land as one PR or three tiny ones.
Acceptance criteria