S3: Enforce bucket policy (#7471)

* evaluate policies during authorization

* cache bucket policy

* refactor

* matching with regex special characters

* Case Sensitivity, pattern cache, Dead Code Removal

* Fixed Typo, Restored []string Case, Added Cache Size Limit

* hook up with policy engine

* remove old implementation

* action mapping

* validate

* if not specified, fall through to IAM checks

* fmt

* Fail-close on policy evaluation errors

* Explicit `Allow` bypasses IAM checks

* fix error message

* arn:seaweed => arn:aws

* remove legacy support

* fix tests

* Clean up bucket policy after this test

* fix for tests

* address comments

* security fixes

* fix tests

* temp comment out

test/s3/iam/iam_config_distributed.json

@@ -40,7 +40,7 @@
   "roles": [
     {
       "roleName": "S3AdminRole",
-      "roleArn": "arn:seaweed:iam::role/S3AdminRole",
+      "roleArn": "arn:aws:iam::role/S3AdminRole",
       "trustPolicy": {
         "Version": "2012-10-17",
         "Statement": [
@@ -63,7 +63,7 @@
     },
     {
       "roleName": "S3ReadOnlyRole",
-      "roleArn": "arn:seaweed:iam::role/S3ReadOnlyRole",
+      "roleArn": "arn:aws:iam::role/S3ReadOnlyRole",
       "trustPolicy": {
         "Version": "2012-10-17",
         "Statement": [
@@ -86,7 +86,7 @@
     },
     {
       "roleName": "S3ReadWriteRole",
-      "roleArn": "arn:seaweed:iam::role/S3ReadWriteRole",
+      "roleArn": "arn:aws:iam::role/S3ReadWriteRole",
       "trustPolicy": {
         "Version": "2012-10-17",
         "Statement": [
@@ -137,8 +137,8 @@
               "s3:ListBucketVersions"
             ],
             "Resource": [
-              "arn:seaweed:s3:::*",
-              "arn:seaweed:s3:::*/*"
+              "arn:aws:s3:::*",
+              "arn:aws:s3:::*/*"
             ]
           }
         ]
@@ -162,8 +162,8 @@
               "s3:ListBucketVersions"
             ],
             "Resource": [
-              "arn:seaweed:s3:::*",
-              "arn:seaweed:s3:::*/*"
+              "arn:aws:s3:::*",
+              "arn:aws:s3:::*/*"
             ]
           }
         ]