Allow specifying an archival policy for AWS buckets

[yuvipanda]

Only enables this for openscapes, which is using it as described in 2i2c-org/features#32.

---

📚 Documentation preview 📚: https://2i2c-pilot-hubs--3563.org.readthedocs.build/en/3563/

[yuvipanda]

I have already applied this.

[consideRatio]

I did a terraform plan on a cluster where this hasn't been applied yet and where archival_storageclass_after wasn't configured (victor) and got this.

Terraform will perform the following actions:

  # aws_s3_bucket_lifecycle_configuration.user_bucket_expiry["scratch"] will be updated in-place
  ~ resource "aws_s3_bucket_lifecycle_configuration" "user_bucket_expiry" {
        id     = "victor-scratch"
        # (1 unchanged attribute hidden)

      + rule {
          + id     = "archival-storageclass"
          + status = "Enabled"

          + transition {
              + storage_class = "GLACIER_IR"
            }
        }

        # (1 unchanged block hidden)
    }

  # aws_s3_bucket_lifecycle_configuration.user_bucket_expiry["scratch-staging"] will be updated in-place
  ~ resource "aws_s3_bucket_lifecycle_configuration" "user_bucket_expiry" {
        id     = "victor-scratch-staging"
        # (1 unchanged attribute hidden)

      + rule {
          + id     = "archival-storageclass"
          + status = "Enabled"

          + transition {
              + storage_class = "GLACIER_IR"
            }
        }

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

It seems off that the rule is created and put in a Enabled state even if archival_storageclass_after is an optional defaulting to null hasn't been explicitly configured. It also renders to an ambugious rule if the transition.days is omitted.

[consideRatio]

@yuvipanda if the final form of this PR will make terraform apply in other clusters apply something harmless, it could be good if you ping engineers about it to provide a heads up that this is a change they can expect to show and not worry about.

[yuvipanda]

Thanks for the check, @consideRatio. I'm actually going to investigate if that stanza can be just made conditional entirely (instead of using enabled / disabled), so it's a no-op elsewhere. If not, I'll post to make sure other engineers are aware of a no-op change.

[yuvipanda]

@consideRatio ok, updated so it is a no-op on clusters that don't use this feature.

[consideRatio]

Thank you @yuvipanda!

I merged this branch to master locally and tested applying this on 2i2c-aws-us: No changes. Your infrastructure matches the configuration..

[consideRatio]

I'll go for a merge here to ensure we get this in and we don't drop the ball on this - as I did now for a month.

Testing to apply this on openscapes led to No changes. Your infrastructure matches the configuration. as well.

[yuvipanda]

Thank you, @consideRatio!