Cross-account replication - Missing permissions

[wszychta]

Describe the Bug

Current version of the module doesn't support cross-account replication because of missing one permission. Based on AWS documentation when both S3 buckets belongs to different AWS accounts you need to add s3:ObjectOwnerOverrideToBucketOwner. Until applying this permission AWS will not be able to replicate objects between accounts.

Expected Behavior

Instead of creating policy statement:

        {
            "Sid": "AllowPrimaryToReplicate",
            "Effect": "Allow",
            "Action": [
                "s3:ReplicateTags",
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:GetObjectVersionTagging",
            ],
            "Resource": "arn:aws:s3:::DESTINATION_BUCKET/*"
        }

Module should create below statement inside replication policy:

        {
            "Sid": "AllowPrimaryToReplicate",
            "Effect": "Allow",
            "Action": [
                "s3:ReplicateTags",
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:GetObjectVersionTagging",
                "s3:ObjectOwnerOverrideToBucketOwner"
            ],
            "Resource": "arn:aws:s3:::DESTINATION_BUCKET/*"
        }

Steps to Reproduce

Steps to reproduce the behavior:

1. Create cross-account replication rule with current module version
2. Try to run it (no success)
3. Add missing s3:ObjectOwnerOverrideToBucketOwner permission
4. Try to run it (success)

Additional Context

Fix should be applied even if replication is set for S3 buckets inside single account. Like in the example below based on module code:

  statement {
    sid    = "AllowPrimaryToReplicate"
    effect = "Allow"
    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete",
      "s3:ReplicateTags",
      "s3:GetObjectVersionTagging",
      "s3:ObjectOwnerOverrideToBucketOwner"
    ]

    resources = ["${var.s3_replica_bucket_arn}/*"]
  }

Adding additonal complexity for enabling this option only when destination bucket is in different account will give zero value. This is because that permission doesn't change anything if it is enabled inside single account.