fix(cdk): grant s3:PutBucketVersioning in bootstrap policy (#404) (#405)

The AttachmentsBucket (cdk/src/constructs/attachments-bucket.ts) sets
`versioned: true`, so CloudFormation calls s3:PutBucketVersioning during
creation. The S3ApplicationBuckets statement in the bootstrap observability
policy grants CreateBucket, PutEncryptionConfiguration,
PutLifecycleConfiguration, PutBucketPublicAccessBlock (+Get), PutBucketTagging
(+Get), etc. — but not s3:PutBucketVersioning, so a fresh
`mise //cdk:bootstrap` + deploy of current main rolls back with:

  cdk-hnb659fds-cfn-exec-role is not authorized to perform
  s3:PutBucketVersioning

Same drift class as #402/#403: a stack feature whose CREATE-time action was
never added to the scoped exec-role policy — invisible to existing stacks
(the action only fires on first bucket creation), fatal to a from-scratch
deploy.

Audit of all three stack buckets (Attachments, TraceArtifacts, Screenshot)
confirms versioning is the only gap; every other feature (encryption,
lifecycle, SSL, public-access-block, tagging) already maps to a granted
action.

Add s3:PutBucketVersioning (create) and s3:GetBucketVersioning (read/drift),
matching the existing Put/Get pairing for PublicAccessBlock and Tagging.
Regenerate bootstrap artifacts and update DEPLOYMENT_ROLES.md golden (+
Starlight mirror) so golden-baseline parity passes. Add a regression guard in
policies.test.ts asserting S3ApplicationBuckets carries an action for each
bucket feature the stack enables.

Fixes #404

Co-authored-by: bgagent <bgagent@noreply.github.com>

Author: isadeks

cdk/bootstrap/bootstrap-template.yaml

@@ -1225,6 +1225,8 @@ Resources:
               - s3:GetBucketPublicAccessBlock
               - s3:PutEncryptionConfiguration
               - s3:PutLifecycleConfiguration
+              - s3:PutBucketVersioning
+              - s3:GetBucketVersioning
               - s3:GetBucketLocation
               - s3:ListBucket
               - s3:PutBucketTagging

cdk/bootstrap/policies/observability.json

@@ -90,6 +90,8 @@
         "s3:GetBucketPublicAccessBlock",
         "s3:PutEncryptionConfiguration",
         "s3:PutLifecycleConfiguration",
+        "s3:PutBucketVersioning",
+        "s3:GetBucketVersioning",
         "s3:GetBucketLocation",
         "s3:ListBucket",
         "s3:PutBucketTagging",

cdk/src/bootstrap/policies/observability.ts

@@ -127,6 +127,8 @@ export function observabilityPolicy(): iam.PolicyDocument {
           's3:GetBucketPublicAccessBlock',
           's3:PutEncryptionConfiguration',
           's3:PutLifecycleConfiguration',
+          's3:PutBucketVersioning',
+          's3:GetBucketVersioning',
           's3:GetBucketLocation',
           's3:ListBucket',
           's3:PutBucketTagging',

cdk/test/bootstrap/policies.test.ts

@@ -247,6 +247,38 @@ describe('IaCRole-ABCA-Observability', () => {
       ]),
     );
   });
+
+  it('S3ApplicationBuckets grants the bucket-feature actions the stack buckets enable', () => {
+    // Regression guard for #404: the exec role must hold a CreateBucket-time
+    // action for every feature the application buckets turn on, or a fresh
+    // deploy rolls back with AccessDenied at that specific configure call.
+    // AttachmentsBucket sets `versioned: true`, so PutBucketVersioning (and
+    // GetBucketVersioning for the read/drift path) are required — they were
+    // missing, which is how this reached main. The service-prefix check above
+    // can't catch it (still `s3:`). If a bucket later enables notifications,
+    // CORS, etc., add the matching action here and to the policy together.
+    const resolvedDoc = stack.resolve(doc);
+    const statements = resolvedDoc.Statement as Array<{
+      Sid: string;
+      Action?: string | string[];
+    }>;
+    const s3Buckets = statements.find((s) => s.Sid === 'S3ApplicationBuckets');
+    expect(s3Buckets).toBeDefined();
+
+    const actions = Array.isArray(s3Buckets!.Action)
+      ? s3Buckets!.Action
+      : [s3Buckets!.Action];
+
+    for (const action of [
+      's3:CreateBucket',
+      's3:PutEncryptionConfiguration',
+      's3:PutLifecycleConfiguration',
+      's3:PutBucketVersioning',
+      's3:GetBucketVersioning',
+    ]) {
+      expect(actions).toContain(action);
+    }
+  });
 });
 
 describe('IaCRole-ABCA-Compute-AgentCore', () => {

docs/design/DEPLOYMENT_ROLES.md

@@ -598,6 +598,8 @@ Bedrock Guardrails, CloudWatch Logs/Dashboards/Alarms, X-Ray, S3 (CDK assets), K
         "s3:GetBucketPublicAccessBlock",
         "s3:PutEncryptionConfiguration",
         "s3:PutLifecycleConfiguration",
+        "s3:PutBucketVersioning",
+        "s3:GetBucketVersioning",
         "s3:GetBucketLocation",
         "s3:ListBucket",
         "s3:PutBucketTagging",

docs/src/content/docs/architecture/Deployment-roles.md

@@ -602,6 +602,8 @@ Bedrock Guardrails, CloudWatch Logs/Dashboards/Alarms, X-Ray, S3 (CDK assets), K
         "s3:GetBucketPublicAccessBlock",
         "s3:PutEncryptionConfiguration",
         "s3:PutLifecycleConfiguration",
+        "s3:PutBucketVersioning",
+        "s3:GetBucketVersioning",
         "s3:GetBucketLocation",
         "s3:ListBucket",
         "s3:PutBucketTagging",