fix: remove explicit aws_s3_bucket_acl

[ryancausey]

This resolves an issue related to the April 2023 S3 API changes. More info can be found here: hashicorp/terraform-provider-aws#28353

Closes #814

Description

Remove the explicit private ACL that leads to an error during the apply phase as with the new security defaults, it should no longer be needed. I'm not 100% on the implications of removing this resource for existing deployments, so if that's a concern we can go the route of adding the explicit aws_s3_bucket_ownership_controls resource as per the related issue.

Migrations required

NO

Verification

• Solves the issue in AccessControlListNotSupported: The bucket does not allow ACLs #814 using the recommendations from: Notice: S3 - Changes to Defaults (Block Public Access and ACL's) hashicorp/terraform-provider-aws#28353
• manually tested and checked that the cache is still accessible

[github-actions]

Hey @ryancausey! 👋

Thank you for your contribution to the project. Please refer to the contribution rules for a quick overview of the process.

Make sure that this PR clearly explains:

• the problem being solved
• the best way a reviewer and you can test your changes

With submitting this PR you confirm that you hold the rights of the code added and agree that it will published under this LICENSE.

The following ChatOps commands are supported:

• /help: notifies a maintainer to help you out

Simply add a comment with the command in the first line. If you need to pass more information, separate it with a blank line from the command.

This message was generated automatically. You are welcome to improve it.

[ryancausey]

/help

lint PR title check failing with Error: Resource not accessible by integration

[kayman-mk]

Had this ACL problem in another repository as well. But it was a new S3 deployment.

[ryancausey]

Had this ACL problem in another repository as well. But it was a new S3 deployment.

Yes, it seems specific to new instantiations of the module.

[ryancausey]

@kayman-mk I tried this using var.runners_executor = "docker" and the cache gets deployed but I'm getting 403 errors when the runner tries to push or pull from the cache. I'm allowing the module to create the cache and I am not specifying my own nor am I using the shared cache.

It looks to me like the only place the local.bucket_policy gets attached to anything is in resource "aws_iam_role_policy_attachment" "docker_machine_cache_instance". This appears to indicate that the bucket policy is never attached to the runner instance itself when not using docker+machine. Is this analysis correct?

I just wanted to confirm that I'm not missing something and that this isn't a side effect of removing the S3 bucket's private ACL resource.

[ryancausey]

Looks to me like it is a separate issue so I opened #816 and #817.

[kayman-mk]

Thanks for your contribution.