[AWS::S3::Bucket] Enabling ObjectLock on an existing bucket is now supported

[blimmer]

Name of the resource

AWS::S3::Bucket

Resource name

No response

Description

According to https://aws.amazon.com/about-aws/whats-new/2023/11/amazon-s3-enabling-object-lock-buckets/ , you can now enable Object Lock on an existing bucket.

However, the CloudFormation change set indicates that it requires replacement:

[
  {
    "type": "Resource",
    "resourceChange": {
      "action": "Modify",
      "logicalResourceId": "Bucket83908E77",
      "physicalResourceId": "foostack-bucket83908e77-x5oftmkjofzs",
      "resourceType": "AWS::S3::Bucket",
      "replacement": "True",
      "scope": [
        "Properties"
      ],
      "details": [
        {
          "target": {
            "attribute": "Properties",
            "name": "ObjectLockEnabled",
            "requiresRecreation": "Always"
          },
          "evaluation": "Static",
          "changeSource": "DirectModification"
        }
      ]
    }
  }
]

Other Details

Originally discovered via: aws/aws-cdk#29168

[kddejong]

This is in progress. I'll try to watch the PR and update the ticket appropriately.