fix(aws): order web public access before policy

[xnoto]

Summary

Make the hidden S3 ordering dependency explicit: every public web-bucket policy waits for the web bucket public-access-block configuration that permits public policies.

No linked issue.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass: OpenTofu test and plan completed successfully; plan is 1 to add, 0 to change, 0 to destroy.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files are affected.

Impact and rollout

• Producer: the central aws_s3_bucket_policy.web resource. Consumers: all current and future members of local.s3_web_buckets.
• The failed main apply 33946347465 created orthodox.channel, its website configuration, its public-access-block configuration, and the narrowly scoped channel-project deployment policy; PutBucketPolicy raced the access-block configuration and failed before creating the anonymous-read policy.
• After CI and explicit approval to merge, the main apply is expected to add only the missing public-read bucket policy to the already-created orthodox.channel resources. It does not dispatch a site deployment, modify Cloudflare, alter the private CloudFront rollback path, or move public traffic.
• Rollback of this source change removes only the explicit dependency. The intentionally public bucket-policy design itself remains owned by the approved public-web bucket class.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI assistance materially produced this change; reviewers should verify that the dependency is limited to aws_s3_bucket_policy.web and that the plan adds only the missing orthodox.channel public-read policy.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # aws_s3_bucket_policy.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_policy" "web" {
      + bucket = "orthodox.channel"
      + id     = (known after apply)
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "s3:GetObject",
                        ]
                      + Effect    = "Allow"
                      + Principal = "*"
                      + Resource  = "arn:aws:s3:::orthodox.channel/*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + region = "us-west-2"
    }

Plan: 1 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # aws_s3_bucket_policy.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_policy" "web" {
      + bucket = "orthodox.channel"
      + id     = (known after apply)
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "s3:GetObject",
                        ]
                      + Effect    = "Allow"
                      + Principal = "*"
                      + Resource  = "arn:aws:s3:::orthodox.channel/*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + region = "us-west-2"
    }

Plan: 1 to add, 0 to change, 0 to destroy.