ORCA Decommission: Enable S3 Versioning (and verify)

[krisstanton]

Understand how to work with S3 Versioning in the context of restoring files.
How will this affect storage?
Enable S3 Versioning on UAT, verify with tests that the versioning works.
Verify that a previous version can be retrieved (even if stored in deep glacier).
We may need a standard way to retrieve these files (script or code that can retrieve a targeted granule as needed)
If everything on UAT checks out, do this in PROD as well and test it there.

[krisstanton]

WIP Update:
S3 Versioning has been enabled on Sandbox and UAT.

[krisstanton]

WIP Update: Set the versioning (previously) on Sandbox and UAT
Examined files, ran tests and experimented a bit with workflows for this process.

Running a normal smoke test should overwrite files that exist in the Bucket 
// Normal Smoke Test
    DOTENV=.env.sandbox make bash
    cumulus rules enable --name PSScene3Band___1_SmokeTest      // 
    cumulus rules run --name PSScene3Band___1_SmokeTest         //
Some Existing files were overwritten.  They now have Version tags

// Retrieve a list of all the objects in the bucket (and save terminal output to `2025_version_checking.json`)
aws s3api list-object-versions --bucket csda-cumulus-myenv-protected > 2025_version_checking.json

// Examining one of the file references in the result json
	"Key": "planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif",

// The section of the output for that one file looks like this (2 versions exist):
// The one that shows "VersionId": "null", is the original file, the one that shows "VersionId": "abcdefghijklmnopXecZ.dPfqygL3j55", is the new file
// I see 2 entries, which is what is expected after running the smoke test.
	{
        "ETag": "\"aaaaaaaaae8cfadbc0dc284bff242c2d-1\"",
        "ChecksumAlgorithm": [
            "CRC64NVME"
        ],
        "Size": 15,
        "StorageClass": "STANDARD",
        "Key": "planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif",
        "VersionId": "abcdefghijklmnopXecZ.dPfqygL3j55",
        "IsLatest": true,
        "LastModified": "2025-10-29T16:04:50+00:00",
        "Owner": {
            "ID": "aaaaaaaaa1234567890abcdefaaaaaaaaa1234567890abcdef"
        }
    },
    {
        "ETag": "\"aaaaaaaaae8cfadbc0dc284bff242c2d-1\"",
        "ChecksumAlgorithm": [
            "CRC64NVME"
        ],
        "Size": 15,
        "StorageClass": "STANDARD",
        "Key": "planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif",
        "VersionId": "null",
        "IsLatest": false,
        "LastModified": "2025-08-28T17:04:26+00:00",
        "Owner": {
            "DisplayName": "csda-app-acctenv-root",
            "ID": "aaaaaaaaa1234567890abcdefaaaaaaaaa1234567890abcdef"
        }
    },

// Next, Manually deleted the file using the AWS Web Console UI

// Confirmed on the AWS Web Console UI that the file is removed from the normal objects list.
// Note, if you click the 'Show versions' switch, you should still see this 'deleted' file with a type called, 'DELETE MARKER'

// Now when I run 
aws s3api list-object-versions --bucket csda-cumulus-myenv-protected > 2025_version_checking_a.json

// I get this relevant output
{
    "ETag": "\"aaaaaaaaae8cfadbc0dc284bff242c2d-1\"",
    "ChecksumAlgorithm": [
        "CRC64NVME"
    ],
    "Size": 15,
    "StorageClass": "STANDARD",
    "Key": "planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif",
    "VersionId": "abcdefghijklmnopXecZ.dPfqygL3j55",
    "IsLatest": false,
    "LastModified": "2025-10-29T16:04:50+00:00",
    "Owner": {
        "ID": "aaaaaaaaa1234567890abcdefaaaaaaaaa1234567890abcdef"
    }
},
{
    "ETag": "\"aaaaaaaaae8cfadbc0dc284bff242c2d-1\"",
    "ChecksumAlgorithm": [
        "CRC64NVME"
    ],
    "Size": 15,
    "StorageClass": "STANDARD",
    "Key": "planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif",
    "VersionId": "null",
    "IsLatest": false,
    "LastModified": "2025-08-28T17:04:26+00:00",
    "Owner": {
        "DisplayName": "csda-app-acctenv-root",
        "ID": "aaaaaaaaa1234567890abcdefaaaaaaaaa1234567890abcdef"
    }
},

At the bottom of the list, this now appears (inside the delete markers area)
	"DeleteMarkers": [
		{
            "Owner": {
                "ID": "aaaaaaaaa1234567890abcdefaaaaaaaaa1234567890abcdef"
            },
            "Key": "planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif",
            "VersionId": "cGtutkUEeceYzGmAabcdefghijklmnop",
            "IsLatest": true,
            "LastModified": "2025-10-29T18:24:58+00:00"
        }

// To restore the file, you have to delete the delete marker....  (Need the bucket, key path to the file AND the version id of the delete marker)
	aws s3api delete-object --bucket csda-cumulus-myenv-protected--key planet/PSScene3Band/20171201_031959_0f31_3B_Analytic.tif --version-id cGtutkUEeceYzGmAabcdefghijklmnop
		// OUTPUT
			{
			    "DeleteMarker": true,
			    "VersionId": "cGtutkUEeceYzGmAabcdefghijklmnop"
			}

// Confirmed on the AWS Web Console UI that the file is now restored

[krisstanton]

WIP Update: Leaving this ticket open until I am able to perform these changes in PROD