feat: Support S3 bucket ABAC (Supersedes #370)

[sharansutrapu]

Description

This PR implements Attribute-Based Access Control (ABAC) for general-purpose S3 buckets via the aws_s3_bucket_abac resource.

This directly supersedes and closes #370, which was unfortunately locked from maintainer edits. I have brought the original implementation into alignment with the module's standards by:

• Using .id instead of .bucket for internal references.
• Removing extraneous region arguments from the sub-resource.
• Deferring all documentation updates to the terraform-docs pre-commit hook rather than manually modifying the READMEs.

Motivation and Context

Closes #372. Closes #370. Enables automatic permission management based on tags attached to buckets.

Breaking Changes

None.

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects
• I have executed pre-commit run -a on my pull request

[RafPe]

@bryantbiggs could you let us know if there are any show stoppers from getting this PR out ? Happy to help if there is some more work to do :)

[github-actions]

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

[RafPe]

Not stale :/

[sharansutrapu]

Thanks for keeping this alive, @RafPe!

[sharansutrapu]

Hi @milosveljkovic and @magreenbaum just giving this a quick bump!

I've just rebased this branch against the latest master and ran all the pre-commit hooks to ensure the documentation and wrappers are perfectly up to date.

this is a lightweight, non-breaking addition that fully resolves #370 and #372. All CI checks are completely green and it's ready for a final review whenever you have a cycle!

[sharansutrapu]

Just rebased this against the fresh "v5.15.3" master to keep everything completely up to date and conflict free. All CI checks are green.

[milosveljkovic]

did you try length(var.abac_status) instead of 'length(keys(var.abac_status))' , should work I think

[milosveljkovic]

Should we be more restrictive about this one? With this setup, it can be whatevery (any). Can we set it to enable 'string' 'Enabled' 'Disabled' and as default null?

something like this:

variable "abac_status" {
  description = "ABAC (Attribute Based Access Control) status for a general-purpose S3 bucket."

  type = object({
    status = optional(string, "Enabled")
  })

  default = null

  validation {
    condition = (
      var.abac_status == null ||
      contains(["Enabled", "Disabled"], var.abac_status.status)
    )
    error_message = "The abac_status.status must be 'Enabled' or 'Disabled'."
  }
}

This is just a suggestion, the current setup is working as expected

[sharansutrapu]

Thanks for the review, @milosveljkovic

I completely agree that strict typing is better here. I've applied both of your suggestions:

1. Updated var.abac_status to strictly enforce the object type and added the validation block for Enabled/Disabled fallbacks.
2. Updated the count condition to safely evaluate the object using try() without crashing on null inputs.

I also rebased against the latest v5.15.4 master and let terraform-docs regenerate all downstream files. Everything is green, tested locally, and ready to go!

[milosveljkovic]

@antonbabenko please take a look here :)