Make s3 bucket policy extend default ssl policy

[anthonyhashemi]

Make s3 bucket policy extend default ssl policy so that we can pass in a policy with extra restrictions but always deny ssl requests as per https://national-archives.atlassian.net/wiki/spaces/DAAE/pages/395477060/Simple+Storage+Service+S3

In action in AYR repo (temporarily pointed it to this branch):
https://github.com/nationalarchives/da-ayr-terraform/pull/166
https://github.com/nationalarchives/da-ayr-terraform/actions/runs/9498690780/job/26177949659

[MancunianSam]

This is really good, thanks.
Could you update the description of the bucket_policy variable to say that it adds a statement with a sid called AllowSSLRequestsOnly and that you don't need to add that to the provided bucket policy.

It's only because if someone passes in a policy which has a statement with that Sid then it will fail so it'd be good to have the variable explain why.

[anthonyhashemi]

This is really good, thanks. Could you update the description of the bucket_policy variable to say that it adds a statement with a sid called AllowSSLRequestsOnly and that you don't need to add that to the provided bucket policy.

It's only because if someone passes in a policy which has a statement with that Sid then it will fail so it'd be good to have the variable explain why.

Ah yeah good shout, will do 👌

[MancunianSam]

👍