fix(cdk): keep the auto-delete Lambda description off the site bucket (SH-300) (#179)

* fix(cdk): keep the auto-delete Lambda description off the site bucket

* style(cdk): format the auto-delete Lambda path check

infra/cdk/lib/frontend-stack.ts

@@ -369,9 +369,25 @@ export class FrontendStack extends Stack {
             node.cfnResourceType === "AWS::IAM::Role" &&
             node.node.path.endsWith("/Custom::S3AutoDeleteObjectsCustomResourceProvider/Role"),
         );
-      if (!rolePolicy || !autoDeleteProviderRole) {
+      const autoDeleteProviderHandler = this.node
+        .findAll()
+        .find(
+          (node): node is CfnResource =>
+            node instanceof CfnResource &&
+            node.cfnResourceType === "AWS::Lambda::Function" &&
+            node.node.path.endsWith("/Custom::S3AutoDeleteObjectsCustomResourceProvider/Handler"),
+        );
+      if (!rolePolicy || !autoDeleteProviderRole || !autoDeleteProviderHandler) {
         throw new Error("Terraform adoption outputs require deploy and auto-delete roles.");
       }
+      // The provider Lambda stays unconditioned so it remains after
+      // ManageSiteInfrastructure=false. Its generated Description Refs the
+      // conditioned bucket and CloudFormation rejects that when the condition
+      // is false. Keep a static description.
+      autoDeleteProviderHandler.addPropertyOverride(
+        "Description",
+        "Lambda function for auto-deleting objects in the site S3 bucket.",
+      );
 
       const recordName = domainNames[0];
       gateOutput(

infra/cdk/test/frontend-stack.test.mjs

@@ -189,6 +189,13 @@ test("adoption mode requires ManageSiteInfrastructure and gates transferred reso
   for (const [outputName, output] of Object.entries(template.Outputs)) {
     assert.equal(output.Condition, CONDITION, outputName);
   }
+
+  const [, autoDeleteHandler] = entriesByType(template, "AWS::Lambda::Function")[0];
+  assert.equal(
+    autoDeleteHandler.Properties.Description,
+    "Lambda function for auto-deleting objects in the site S3 bucket.",
+  );
+  assert.equal(typeof autoDeleteHandler.Properties.Description, "string");
 });
 
 test("normal mode is unchanged: destructive cleanup, StringLike trust, no boundary, tag, or parameter", () => {