feat(s3): supports RemovalPolicy for BucketPolicy

[njlynch]

Exposes RemovalPolicy on the BucketPolicyProps so bucket policies can be
retained when a stack is deleted.

I'm conflicted about this implementation, because it seems the more recommended
way to create/associate policies with buckets is to use the addToResourcePolicy
(or the grant*) methods. One option would be to have the addToResourcePolicy
call set the removal policy on the bucket policy to whatever the policy is for
the bucket itself; however, that would be a backwards-incompatible change, and
so would need a feature flag.

Curious for feedback from the core members on this approach.

fixes #7415

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 978cccc
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[iliapolo]

@njlynch you mentioned:

One option would be to have the addToResourcePolicy
call set the removal policy on the bucket policy to whatever the policy is for
the bucket itself; however, that would be a backwards-incompatible change

Yeah, I wouldn't go down that road...

Since the Bucket construct exposes its policy using the policy attribute, I suggest adding an API to the BucketPolicy ti support configuring it:

const bucket = new s3.Bucket(this, 'Bucket', {});
bucket.policy?.setRemovalPolicy(RemovalPolicy.DELETE);

WDYT?

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: f9b8573
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 9a8801a
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 43e0160
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).