(aws-s3): "s3: PutBucketPolicy" is added when autoDeleteObjects=True, in CDK Version 2.100

[khushail]

Describe the bug

SIM Ticket - V1347352006

This PR added "s3:PutBucketPolicy" when autoDeleteObjects is set to True in CDK Version 2.100

Expected Behavior

the policy should not be added by default

Current Behavior

creating a bucket with "autoDeleteObject: true" automatically added "s3:PutBucketPolicy".

Reproduction Steps

1. Run below code with CDK 2.99

    const bucket100 = new s3.Bucket(this, 'Bucket100', {
      versioned: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true
    });

This policy generated -

  "Bucket": {
    "Ref": "Bucket9970D96479"
   },
   "PolicyDocument": {
    "Statement": [
     {
      "Action": [
       "s3:DeleteObject*",
       "s3:GetBucket*",
       "s3:List*"
      ],
      "Effect": "Allow",
      "Principal": {
       "AWS": {
        "Fn::GetAtt": [
         "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
         "Arn"
        ]
       }
      },

2. npm uninstall -g aws-cdk
3. npm cache clean --force
4. npm install -g aws-cdk@2.100
5. Run above code and do 'cdk synth'
6. Policy generated -

"Bucket": {
     "Ref": "Bucket1000EAAE573"
    },
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "s3:DeleteObject*",
        "s3:GetBucket*",
        "s3:List*",
        "s3:PutBucketPolicy"
       ],
       "Effect": "Allow",
       "Principal": {
        "AWS": {
         "Fn::GetAtt": [
          "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
          "Arn"
         ]
        }

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.100

Framework Version

No response

Node.js Version

na

OS

mac

Language

TypeScript

Language Version

No response

Other information

No response

[SankyRed]

@khushail After discussing with the team, it's clear that adding the new s3:PutBucketPolicy is not a breaking change. In fact, it'll help us tackle some problems with race conditions while we're cleaning up s3 buckets. We just need to update the documentation to let the community know about this policy.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.