terraform s3 object delete on versioned bucket lifecycle rule

I've searched a few posts, but none fully make sense to me. Hopefully, I can write this question more clearly for future searches.

• I have a versioned bucket
• I have objects that are transitioned to Glacier after 180 days

This is done in terraform using the following

resource "aws_s3_bucket" "main" {
  bucket = "zzz-bucket-127364-${terraform.workspace}"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  lifecycle_rule {
    enabled = true

    transition {
      days          = 180
      storage_class = "GLACIER"
    }
  }
  
  versioning {
    enabled = true
  }
}

I need the following:

• Delete all objects older than 365 days (irrespective of their storage class)

I need it to permanently delete the object (not just create a delete marker, but remove the file completely from S3).

Is it just a matter of setting the expiration property?

resource "aws_s3_bucket" "main" {
  bucket = "zzz-bucket-127364-${terraform.workspace}"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  lifecycle_rule {
    enabled = true

    transition {
      days          = 180
      storage_class = "GLACIER"
    }
    
    expiration {
      days = 365
    }
 }
  
  versioning {
    enabled = true
  }
}

Or do I need to do something with noncurrent_version_expiration?

Thanks in advance.

First of all, it is recommended to use aws_s3_bucket_lifecycle_configuration resource block instead of specifying inside the aws_s3_bucket block

Answer to your requirement, yes, you must use noncurrent_version_transition block for versioned objects expiration.

resource "aws_s3_bucket_lifecycle_configuration" "lifecycle" {
depends_on = [aws_s3_bucket_versioning.<the_versioning_block_name>]

  bucket = aws_s3_bucket.bucket.id

  rule {
    id = "expiration-365"

    status = "Enabled"

    noncurrent_version_transition {
        noncurrent_days = 180
        storage_class   = "GLACIER"
    }
    noncurrent_version_expiration {
        newer_noncurrent_versions = 0
        noncurrent_days           = 365
      }
    }
  }
}

To add lifecycle in your existing S3 resource block legacy method, this should do it

resource "aws_s3_bucket" "main" {
  bucket = "zzz-bucket-127364-${terraform.workspace}"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  lifecycle_rule {
    id = "expiration-365"
    enabled = true

    noncurrent_version_transition {
        days          = 180
        storage_class = "GLACIER"
    }

    noncurrent_version_expiration {
        noncurrent_version_expiration = 365
      }
    }
  }
  
  versioning {
    enabled = true
  }
}