* s3: require their own actions to change a bucket's CORS or versioning
PUT/DELETE ?cors and PUT ?versioning were authorized as Write, so an
identity granted only object writes on a bucket could replace its CORS
rules or suspend versioning. They now need PutBucketCors,
DeleteBucketCors and PutBucketVersioning (or Admin), and inline policies
granting s3:PutBucketCors, s3:DeleteBucketCors or s3:PutBucketVersioning
map to those actions instead of Write.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* s3: test that object Write cannot change bucket CORS or versioning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: offer the bucket CORS and versioning permissions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* s3: test each bucket config action with its own identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
