fix: complete channel site bucket refresh reads

[xnoto]

Summary

Add the remaining bucket-scoped S3 read actions invoked by the AWS provider aws_s3_bucket refresh path for the two project-owned site buckets.

After PR #44 applied s3:ListBucket, the rerun channel-project PR #15 plan reached the actual bucket reads and failed on the first omitted action, s3:GetBucketCors. Provider v6.63 refreshes policy, ACL, CORS, website, versioning, accelerate, request-payment, logging, lifecycle, replication, encryption, object-lock, and region configuration. This adds only the seven still-missing read actions, restricted to the same two bucket ARNs in the existing infrastructure policy.

Fixes # N/A — recovery prerequisite for channel-project PR #15.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files are affected.

No local OpenTofu, state, import, plan, or apply operation was run or claimed. The provider source and current v6.63 resource documentation were inspected to enumerate the resource refresh calls after the credentialed consumer plan identified the first missing action.

Impact and rollout

Producer: tfroot-aws owns the infrastructure role and inline policy. Consumer: channel-project/tofu/aws assumes that role through the reusable OpenTofu workflow.

After merge and environment-gated main apply, rerun the channel-project PR plan. It must refresh both existing buckets without an access-denied error and must not plan replacement buckets. This change does not create/delete buckets, upload site assets, create a CloudFront distribution, issue ACM certificates, or change DNS.

Rollback before apply is closing/reverting this PR. If applied, reverting removes only provider-refresh read permissions and should not occur while this consumer root requires the role.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI agent materially produced this change; reviewers should verify the seven actions are read-only, confined to the two project-owned bucket ARNs, and required by the provider refresh path.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_infrastructure will be updated in-place
  ~ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructure" {
        id     = "github-actions-channel-project-site-infrastructure:channel-project-site-infrastructure"
        name   = "channel-project-site-infrastructure"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (3 unchanged elements hidden)
                    {
                        Action   = [
                            "s3:CreateBucket",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "CreateSiteBuckets"
                    },
                  ~ {
                      ~ Action   = [
                            # (1 unchanged element hidden)
                            "s3:DeleteBucketPolicy",
                          + "s3:GetBucketAccelerateConfiguration",
                            "s3:GetBucketAcl",
                          + "s3:GetBucketCors",
                            "s3:GetBucketEncryption",
                            # (1 unchanged element hidden)
                            "s3:GetBucketLocation",
                          + "s3:GetBucketLogging",
                          + "s3:GetBucketObjectLockConfiguration",
                            "s3:GetBucketOwnershipControls",
                            # (1 unchanged element hidden)
                            "s3:GetBucketPublicAccessBlock",
                          + "s3:GetBucketReplication",
                          + "s3:GetBucketRequestPayment",
                            "s3:GetBucketTagging",
                            "s3:GetBucketVersioning",
                          + "s3:GetBucketWebsite",
                            "s3:ListBucket",
                            # (8 unchanged elements hidden)
                        ]
                        # (3 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "cloudfront:CreateOriginAccessControl",
                            "cloudfront:DeleteOriginAccessControl",
                            "cloudfront:GetOriginAccessControl",
                            "cloudfront:GetOriginAccessControlConfig",
                            "cloudfront:ListOriginAccessControls",
                            "cloudfront:UpdateOriginAccessControl",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "ManageSiteOriginAccessControl"
                    },
                    # (2 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_infrastructure will be updated in-place
  ~ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructure" {
        id     = "github-actions-channel-project-site-infrastructure:channel-project-site-infrastructure"
        name   = "channel-project-site-infrastructure"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (3 unchanged elements hidden)
                    {
                        Action   = [
                            "s3:CreateBucket",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "CreateSiteBuckets"
                    },
                  ~ {
                      ~ Action   = [
                            # (1 unchanged element hidden)
                            "s3:DeleteBucketPolicy",
                          + "s3:GetBucketAccelerateConfiguration",
                            "s3:GetBucketAcl",
                          + "s3:GetBucketCors",
                            "s3:GetBucketEncryption",
                            # (1 unchanged element hidden)
                            "s3:GetBucketLocation",
                          + "s3:GetBucketLogging",
                          + "s3:GetBucketObjectLockConfiguration",
                            "s3:GetBucketOwnershipControls",
                            # (1 unchanged element hidden)
                            "s3:GetBucketPublicAccessBlock",
                          + "s3:GetBucketReplication",
                          + "s3:GetBucketRequestPayment",
                            "s3:GetBucketTagging",
                            "s3:GetBucketVersioning",
                          + "s3:GetBucketWebsite",
                            "s3:ListBucket",
                            # (8 unchanged elements hidden)
                        ]
                        # (3 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "cloudfront:CreateOriginAccessControl",
                            "cloudfront:DeleteOriginAccessControl",
                            "cloudfront:GetOriginAccessControl",
                            "cloudfront:GetOriginAccessControlConfig",
                            "cloudfront:ListOriginAccessControls",
                            "cloudfront:UpdateOriginAccessControl",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "ManageSiteOriginAccessControl"
                    },
                    # (2 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.