what

• Added an optional bucket_policy_conditions argument to the terraform-aws-s3-bucket module.
• This argument allows users to specify IAM policy conditions for the S3 bucket policy, particularly for privileged_principal_arns.
• Ensured that the addition is backward compatible and does not affect existing module users.

why

• Enhanced Security: By allowing conditions in IAM policies, users can restrict access based on specific AWS elements like VPC endpoints, source IP addresses, or user attributes. This is crucial for sensitive or regulated data stored in S3 buckets.
• Increased Flexibility: Users now have more control over their S3 bucket policies, enabling them to tailor access more precisely to their organizational requirements.
• Alignment with AWS Best Practices: Adding conditions to IAM policies is recommended as part of AWS security best practices. It helps in achieving the principle of least privilege.
• Community Request: This feature was requested by several users (refer to issue Add Support for Condition Block in Privileged Principal ARNs IAM Policy for S3 Bucket #210 ) to meet specific use cases not currently supported by the module.

references

• Closes Add Support for Condition Block in Privileged Principal ARNs IAM Policy for S3 Bucket #210 - GitHub issue requesting the ability to add condition blocks to the S3 bucket IAM policy. AWS Documentation on IAM Policy Conditions: AWS Policy Conditions
• Terraform AWS Provider Documentation: Terraform AWS S3 Bucket