Identify and enforce a retention period for edx-platform grades

[blarghmatey]

User Story

• As an Open edX operator I would like to reduce the total amount of state that we need to keep around for compliance, cost, and security reasons

Description/Context

We have a lot of grade files stored in S3 that are generated by grade reports tasks run via the instructor dashboard. Do we need to keep all of those grades for all time? If the answer is no, then how long do we need to keep those files for?

In the event that we want to manage a certain amount of history then we will need to add a lifecycle policy to the S3 bucket for edxapp-grades.

Acceptance Criteria

• [ ] S3 buckets that contain grade reports have a lifecycle policy applied that delete the reports after 90 days

[pdpinch]

Sorry I missed this.

The Instructor Dashboard UI says

Report files are deleted 90 days after generation. If you will need access to old reports, download and store the files, in accordance with your institution's data security policies.

I guess that policy isn't enforced by the application itself?