Q: Developers create S3 buckets manually, often forgetting SSE-KMS encryption, omitting public access blocks, and leaving terabytes of unexpiring logs that inflate cloud bills. How do you build a Crossplane self-service bucket vending system that guarantees compliance by design?

Expose only developer-relevant fields: bucket purpose, retention days, and lifecycle tiering.

apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xappstorages.platform.acme.com
spec:
  group: platform.acme.com
  names: { kind: XAppStorage, plural: xappstorages }
  claimNames: { kind: AppStorage, plural: appstorages }
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              properties:
                lifecycleDays: { type: integer, default: 90 }
                enableVersioning: { type: boolean, default: true }

The Composition renders an AWS S3 Bucket, PublicAccessBlock, ServerSideEncryptionConfiguration, and LifecycleConfiguration automatically.

# Composition resource snippet
- name: s3-public-access-block
  base:
    apiVersion: s3.aws.upjet.crossplane.io/v1beta1
    kind: BucketPublicAccessBlock
    spec:
      forProvider:
        blockPublicAcls: true
        blockPublicPolicy: true
        ignorePublicAcls: true
        restrictPublicBuckets: true

Crossplane generates a scoped IAM policy granting read/write access to that specific bucket ARN only, exporting the policy ARN to a Kubernetes Secret in the developer's namespace.