feat(bucket): Merge BucketPolicy with Bucket

[MisterMX]

Description of your changes

This adds a new field spec.forProvider.policy to Bucket to merge the functionality of BucketPolicy into the former.

To avoid breaking changes with existing setups, policies are never deleted by the bucket controller by default. If spec.forProvider.policy is nil, the controller will do nothing.

To change this behaviour the user can set the new field spec.forProvider.policyUpdatePolicy.deletionPolicy to IfNull (default is Never). This way, the controller will delete the external AWS policy.

This also deprecates BucketPolicy with a warning to use the policy field in Bucket instead.

Fixes #1684

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

See the provided example.

[haarchri]

LGTM

[tcd156]

The deprecation warning log is firing in the provider-aws pod constantly, even though I have no BucketPolicies specified.

Also, given that we can't infer the ARN of the bucket, is there a suggested method to easily interpolate that value into the policy?

[tcd156]

Without BucketPolicy, this creates a situation that I'm in where I want to create an S3 bucket, and a CloudFront distribution.

The Distribution needs the Bucket, but the Bucket needs the Distribution ARN in order to set the policy so that only CloudFront can communicate to the Bucket.

So neither can be created without the other.

[MisterMX]

The deprecation warning log is firing in the provider-aws pod constantly, even though I have no BucketPolicies specified.

That sounds more like an issue with the underlying k8s.io/client-go because its spams every log directly to stderr.

Also, given that we can't infer the ARN of the bucket, is there a suggested method to easily interpolate that value into the policy?

When you are creating a bucket MR you are also know the external name of the bucket. You can derive the ARN of the bucket as long as you know the ID of the AWS account it is created in.

The Distribution needs the Bucket, but the Bucket needs the Distribution ARN in order to set the policy so that only CloudFront can communicate to the Bucket.

Wouldn't it work if you create the bucket without a policy and add it later, once cloudfront has been initialized?

[tcd156]

Yes, and it does - however, the intent here is to deprecate bucket policy, no?