Add IAM Role reference to Bucket replication role (#231)

Description of changes:
Adds a cross-resource reference from the S3 Bucket replication configuration's `role` field (`replication.role`) to the ACK `iam/Role` resource, allowing the replication IAM role to be resolved from an IAM Role CR via `replication.roleRef`.

Note: the scanner also flagged `analytics...s3BucketDestination.bucket` (-> Bucket) and `bucketAccountID` (-> Account); these were skipped — the destination bucket field is a deeply nested analytics export target (not a clean reference) and Account is not an ACK resource.

Generated with code-generator `v0.60.0` / runtime `v0.60.0`, `AWS_SDK_GO_VERSION=v1.41.5`.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Author: gustavodiaz7722

ATTRIBUTION.md

@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2026-06-22T23:09:33Z"
+  build_date: "2026-06-23T05:04:49Z"
   build_hash: 2ae5d2cfadaa2a10b2ccb9e73a111b2a91c36642
-  go_version: go1.26.4
+  go_version: go1.26.0
   version: v0.60.0
-api_directory_checksum: e23232dc2504a712abd593de099adfb68140c13d
+api_directory_checksum: 82eae937654efbb0f91e00b8bfb54d06f92b5d75
 api_version: v1alpha1
 aws_sdk_go_version: v1.41.5
 generator_config_info:
-  file_checksum: af8a694dab3af352fabd5a246bf14aea6262f45e
+  file_checksum: f61dc4673c14b0e475c046ce7a3a77bda0fff5f9
   original_file_name: generator.yaml
 last_modification:
   reason: API generation

apis/v1alpha1/ack-generate-metadata.yaml

@@ -90,6 +90,11 @@ resources:
         from:
           operation: PutBucketReplication
           path: ReplicationConfiguration
+      Replication.Role:
+        references:
+          service_name: iam
+          resource: Role
+          path: Status.ACKResourceMetadata.ARN
       RequestPayment:
         from:
           operation: PutBucketRequestPayment

apis/v1alpha1/generator.yaml

@@ -963,6 +963,20 @@ spec:
                 properties:
                   role:
                     type: string
+                  roleRef:
+                    description: Reference field for Role
+                    properties:
+                      from:
+                        description: |-
+                          AWSResourceReference provides all the values necessary to reference another
+                          k8s resource for finding the identifier(Id/ARN/Name)
+                        properties:
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                        type: object
+                    type: object
                   rules:
                     items:
                       description: Specifies which Amazon S3 objects to replicate

apis/v1alpha1/types.go

@@ -22,6 +22,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - iam.services.k8s.aws
+  resources:
+  - roles
+  - roles/status
+  verbs:
+  - get
+  - list
 - apiGroups:
   - s3.services.k8s.aws
   resources:

apis/v1alpha1/zz_generated.deepcopy.go

@@ -90,6 +90,11 @@ resources:
         from:
           operation: PutBucketReplication
           path: ReplicationConfiguration
+      Replication.Role:
+        references:
+          service_name: iam
+          resource: Role
+          path: Status.ACKResourceMetadata.ARN
       RequestPayment:
         from:
           operation: PutBucketRequestPayment

cmd/controller/main.go

@@ -3,6 +3,7 @@ module github.com/aws-controllers-k8s/s3-controller
 go 1.25.0
 
 require (
+	github.com/aws-controllers-k8s/iam-controller v1.7.2
 	github.com/aws-controllers-k8s/runtime v0.60.0
 	github.com/aws/aws-sdk-go v1.49.0
 	github.com/aws/aws-sdk-go-v2 v1.41.5