call DeletePolicy if bucket policy is empty (#201)

Issue [#2731](aws-controllers-k8s/community#2731)

Description of changes:
currently, we call DeletePolicy is not nil. This causes issues if the 
value of the bucket policy is an empty string. 
With these changes, we call DeletePolicy when the bucket policy is nil
or empty.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Author: michaelhtm

pkg/resource/bucket/hook.go

@@ -1283,7 +1283,7 @@ func (rm *resourceManager) syncPolicy(
 	ctx context.Context,
 	r *resource,
 ) (err error) {
-	if r.ko.Spec.Policy == nil {
+	if r.ko.Spec.Policy == nil || *r.ko.Spec.Policy == "" {
 		return rm.deletePolicy(ctx, r)
 	}
 	return rm.putPolicy(ctx, r)

test/e2e/resources/bucket_empty_policy.yaml

@@ -0,0 +1,7 @@
+apiVersion: s3.services.k8s.aws/v1alpha1
+kind: Bucket
+metadata:
+  name: $BUCKET_NAME
+spec:
+  name: $BUCKET_NAME
+  policy: ""

test/e2e/tests/test_bucket.py

@@ -147,6 +147,7 @@ def test_put_fields(self, s3_client, s3_resource, basic_bucket):
         self._update_assert_notification(basic_bucket, s3_resource)
         self._update_assert_ownership_controls(basic_bucket, s3_client)
         self._update_assert_policy(basic_bucket, s3_resource)
+        self._update_assert_empty_policy(basic_bucket, s3_resource)
         self._update_assert_public_access_block(basic_bucket, s3_client)
         self._update_assert_replication(basic_bucket, s3_client)
         self._update_assert_request_payment(basic_bucket, s3_resource)
@@ -247,6 +248,21 @@ def _update_assert_policy(self, bucket: Bucket, s3_resource):
 
         assert desired == latest
 
+    def _update_assert_empty_policy(self, bucket: Bucket, s3_resource):
+        replace_bucket_spec(bucket, "bucket_empty_policy")
+
+        latest = get_bucket(s3_resource, bucket.resource_name)
+        policy = latest.Policy()
+
+        try:
+            policy.policy
+        except Exception as e:
+            assert "NoSuchBucketPolicy" in str(e)
+            return
+        
+        # if there is no error, fail test
+        assert False
+
     def _update_assert_public_access_block(self, bucket: Bucket, s3_client):
         replace_bucket_spec(bucket, "bucket_public_access_block")