Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Allow configuring "Object Ownership"

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
README.md
@@ -125,6 +125,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
 | [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
@@ -148,6 +149,7 @@ No modules.
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
+|  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 |  [create\_bucket](#input\_create\_bucket) | Controls if S3 bucket should be created | `bool` | `true` | no |
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
@@ -156,6 +158,7 @@ No modules.
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
+|  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
 |  [policy](#input\_policy) | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
 |  [replication\_configuration](#input\_replication\_configuration) | Map containing cross-region replication configuration. | `any` | `{}` | no |
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -213,4 +213,8 @@ module "s3_bucket" {
   block_public_policy     = true
   ignore_public_acls      = true
   restrict_public_buckets = true
+
+  # S3 Bucket Ownership Controls
+  control_object_ownership = true
+  object_ownership         = "BucketOwnerPreferred"
 }
---
main.tf
@@ -376,10 +376,29 @@ resource "aws_s3_bucket_public_access_block" "this" {

   # Chain resources (s3_bucket -> s3_bucket_policy -> s3_bucket_public_access_block)
   # to prevent "A conflicting conditional operation is currently in progress against this resource."
+  # Ref: https://github.com/hashicorp/terraform-provider-aws/issues/7628
+
   bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id

   block_public_acls       = var.block_public_acls
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
 }
+
+resource "aws_s3_bucket_ownership_controls" "this" {
+  count = var.create_bucket && var.control_object_ownership ? 1 : 0
+
+  bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id
+
+  rule {
+    object_ownership = var.object_ownership
+  }
+
+  # This `depends_on` is to prevent "A conflicting conditional operation is currently in progress against this resource."
+  depends_on = [
+    aws_s3_bucket_policy.this,
+    aws_s3_bucket_public_access_block.this,
+    aws_s3_bucket.this
+  ]
+}
---
variables.tf
@@ -159,3 +159,15 @@ variable "restrict_public_buckets" {
   type        = bool
   default     = false
 }
+
+variable "control_object_ownership" {
+  description = "Whether to manage S3 Bucket Ownership Controls on this bucket."
+  type        = bool
+  default     = false
+}
+
+variable "object_ownership" {
+  description = "Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL."
+  type        = string
+  default     = "ObjectWriter"
+}
---

---

Choice B:
README.md
@@ -125,6 +125,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
 | [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
@@ -148,6 +149,7 @@ No modules.
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
+|  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no for |  [create\_bucket](#input\_create\_bucket) | Controls if S3 bucket should be created | `bool` | `true` | no |
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
@@ -156,6 +158,7 @@ No modules.
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
+|  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
 |  [policy](#input\_policy) | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
 |  [replication\_configuration](#input\_replication\_configuration) | Map containing cross-region replication configuration. | `any` | `{}` | no |
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -213,4 +213,8 @@ module "s3_bucket" {
   block_public_policy     = true
   ignore_public_acls      = true
   restrict_public_buckets = true
+
+  # S3 Bucket Ownership Controls
+  control_object_ownership = true
+  object_ownership         = "BucketOwnerPreferred"
 }
---
main.tf
@@ -376,10 +376,29 @@ resource "aws_s3_bucket_public_access_block" "this" {

   # Chain resources (s3_bucket -> s3_bucket_policy -> s3_bucket_public_access_block)
   # to prevent "A conflicting conditional operation is currently in progress against this resource."
+  # Ref: https://github.com/hashicorp/terraform-provider-aws/issues/7628
+
   bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id

   block_public_acls       = var.block_public_acls
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
 }
+
+resource "aws_s3_bucket_ownership_controls" "this" {
+  count = var.create_bucket && var.control_object_ownership ? 1 : 0
+
+  bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id
+
+  rule {
+    object_ownership = var.object_ownership
+  }
+
+  # This `depends_on` is to prevent "A conflicting conditional operation is currently in progress against this resource."
+  depends_on = [
+    aws_s3_bucket_policy.this,
+    aws_s3_bucket_public_access_block.this,
+    aws_s3_bucket.this
+  ]
+}
---
variables.tf
@@ -159,3 +159,15 @@ variable "restrict_public_buckets" {
   type        = bool
   default     = false
 }
+
+variable "control_object_ownership" {
+  description = "Whether to manage S3 Bucket Ownership Controls on this bucket."
+  type        = bool
+  default     = false
+}
+
+variable "object_ownership" {
+  description = "Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL."
+  type        = string
+  default     = "ObjectWriter"
+}
---

---

Choice C:
README.md
@@ -125,6 +125,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
 | [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
@@ -148,6 +149,7 @@ No modules.
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
+|  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 |  [create\_bucket](#input\_create\_bucket) | Controls if S3 bucket should be created | `bool` | `true` | no |
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
@@ -156,6 +158,7 @@ No modules.
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
+|  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
 |  [policy](#input\_policy) | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. account this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
 |  [replication\_configuration](#input\_replication\_configuration) | Map containing cross-region replication configuration. | `any` | `{}` | no |
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -213,4 +213,8 @@ module "s3_bucket" {
   block_public_policy     = true
   ignore_public_acls      = true
   restrict_public_buckets = true
+
+  # S3 Bucket Ownership Controls
+  control_object_ownership = true
+  object_ownership         = "BucketOwnerPreferred"
 }
---
main.tf
@@ -376,10 +376,29 @@ resource "aws_s3_bucket_public_access_block" "this" {

   # Chain resources (s3_bucket -> s3_bucket_policy -> s3_bucket_public_access_block)
   # to prevent "A conflicting conditional operation is currently in progress against this resource."
+  # Ref: https://github.com/hashicorp/terraform-provider-aws/issues/7628
+
   bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id

   block_public_acls       = var.block_public_acls
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
 }
+
+resource "aws_s3_bucket_ownership_controls" "this" {
+  count = var.create_bucket && var.control_object_ownership ? 1 : 0
+
+  bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id
+
+  rule {
+    object_ownership = var.object_ownership
+  }
+
+  # This `depends_on` is to prevent "A conflicting conditional operation is currently in progress against this resource."
+  depends_on = [
+    aws_s3_bucket_policy.this,
+    aws_s3_bucket_public_access_block.this,
+    aws_s3_bucket.this
+  ]
+}
---
variables.tf
@@ -159,3 +159,15 @@ variable "restrict_public_buckets" {
   type        = bool
   default     = false
 }
+
+variable "control_object_ownership" {
+  description = "Whether to manage S3 Bucket Ownership Controls on this bucket."
+  type        = bool
+  default     = false
+}
+
+variable "object_ownership" {
+  description = "Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL."
+  type        = string
+  default     = "ObjectWriter"
+}
---

---

Choice D:
README.md
@@ -125,6 +125,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
 | [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
@@ -148,6 +149,7 @@ No modules.
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
+| <a are [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 |  [create\_bucket](#input\_create\_bucket) | Controls if S3 bucket should be created | `bool` | `true` | no |
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
@@ -156,6 +158,7 @@ No modules.
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
+|  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
 |  [policy](#input\_policy) | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
 |  [replication\_configuration](#input\_replication\_configuration) | Map containing cross-region replication configuration. | `any` | `{}` | no |
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -213,4 +213,8 @@ module "s3_bucket" {
   block_public_policy     = true
   ignore_public_acls      = true
   restrict_public_buckets = true
+
+  # S3 Bucket Ownership Controls
+  control_object_ownership = true
+  object_ownership         = "BucketOwnerPreferred"
 }
---
main.tf
@@ -376,10 +376,29 @@ resource "aws_s3_bucket_public_access_block" "this" {

   # Chain resources (s3_bucket -> s3_bucket_policy -> s3_bucket_public_access_block)
   # to prevent "A conflicting conditional operation is currently in progress against this resource."
+  # Ref: https://github.com/hashicorp/terraform-provider-aws/issues/7628
+
   bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id

   block_public_acls       = var.block_public_acls
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
 }
+
+resource "aws_s3_bucket_ownership_controls" "this" {
+  count = var.create_bucket && var.control_object_ownership ? 1 : 0
+
+  bucket = local.attach_policy ? aws_s3_bucket_policy.this[0].id : aws_s3_bucket.this[0].id
+
+  rule {
+    object_ownership = var.object_ownership
+  }
+
+  # This `depends_on` is to prevent "A conflicting conditional operation is currently in progress against this resource."
+  depends_on = [
+    aws_s3_bucket_policy.this,
+    aws_s3_bucket_public_access_block.this,
+    aws_s3_bucket.this
+  ]
+}
---
variables.tf
@@ -159,3 +159,15 @@ variable "restrict_public_buckets" {
   type        = bool
   default     = false
 }
+
+variable "control_object_ownership" {
+  description = "Whether to manage S3 Bucket Ownership Controls on this bucket."
+  type        = bool
+  default     = false
+}
+
+variable "object_ownership" {
+  description = "Object ownership. Valid values: BucketOwnerPreferred or ObjectWriter. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL."
+  type        = string
+  default     = "ObjectWriter"
+}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Fixes #93
Based on #95 (closes #95)

---

Choice A:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- ALB/NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with ALB/NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_lb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -113,6 +130,7 @@ No modules.
 | [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -122,6 +140,7 @@ No modules.
 | <a name="input_acl"></a> [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 | <a name="input_attach_deny_insecure_transport_policy"></a> [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 | <a name="input_attach_elb_log_delivery_policy"></a> [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+| <a name="input_attach_lb_log_delivery_policy"></a> [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 | <a name="input_attach_policy"></a> [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 | <a name="input_attach_public_policy"></a> [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 | <a name="input_block_public_acls"></a> [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/README.md
@@ -2,7 +2,7 @@

 Configuration in this directory creates S3 bucket which demos such capabilities:
 - static web-site hosting
-- access logging (for S3 and ELB)
+- access logging (for S3, ELB and ALB/NLB)
 - versioning
 - CORS
 - lifecycle rules
---
examples/complete/main.tf
@@ -55,6 +55,7 @@ module "log_bucket" {
   acl                                   = "log-delivery-write"
   force_destroy                         = true
   attach_elb_log_delivery_policy        = true
+  attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
 }

---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+ Amazon   var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# ALB/NLB
+
+data "aws_iam_policy_document" "lb_log_delivery" {
+  count = var.create_bucket && var.attach_lb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_lb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have ALB/NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---
wrappers/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

---
wrappers/main.tf
@@ -5,6 +5,7 @@ module "wrapper" {

   create_bucket                         = lookup(each.value, "create_bucket", true)
   attach_elb_log_delivery_policy        = lookup(each.value, "attach_elb_log_delivery_policy", false)
+  attach_lb_log_delivery_policy         = lookup(each.value, "attach_lb_log_delivery_policy", false)
   attach_deny_insecure_transport_policy = lookup(each.value, "attach_deny_insecure_transport_policy", false)
   attach_policy                         = lookup(each.value, "attach_policy", false)
   attach_public_policy                  = lookup(each.value, "attach_public_policy", true)
---

---

Choice B:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- ALB/NLB log delivery bucket policy

 ## Usage
 modules.
 -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with ALB/NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_lb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -113,6 +130,7 @@ No modules.
 | [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -122,6 +140,7 @@ No modules.
 |  [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 |  [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 |  [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+|  [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/README.md
@@ -2,7 +2,7 @@

 Configuration in this directory creates S3 bucket which demos such capabilities:
 - static web-site hosting
-- access logging (for S3 and ELB)
+- access logging (for S3, ELB and ALB/NLB)
 - versioning
 - CORS
 - lifecycle rules
---
examples/complete/main.tf
@@ -55,6 +55,7 @@ module "log_bucket" {
   acl                                   = "log-delivery-write"
   force_destroy                         = true
   attach_elb_log_delivery_policy        = true
+  attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
 }

---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# ALB/NLB
+
+data "aws_iam_policy_document" "lb_log_delivery" {
+  count = var.create_bucket && var.attach_lb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_lb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have ALB/NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---
wrappers/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

---
wrappers/main.tf
@@ -5,6 +5,7 @@ module "wrapper" {

   create_bucket                         = lookup(each.value, "create_bucket", true)
   attach_elb_log_delivery_policy        = lookup(each.value, "attach_elb_log_delivery_policy", false)
+  attach_lb_log_delivery_policy         = lookup(each.value, "attach_lb_log_delivery_policy", false)
   attach_deny_insecure_transport_policy = lookup(each.value, "attach_deny_insecure_transport_policy", false)
   attach_policy                         = lookup(each.value, "attach_policy", false)
   attach_public_policy                  = lookup(each.value, "attach_public_policy", true)
---

---

Choice C:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- ALB/NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with ALB/NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_lb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -113,6 +130,7 @@ No modules.
 | [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -122,6 +140,7 @@ No modules.
 | <a name="input_acl"></a> [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 | <a name="input_attach_deny_insecure_transport_policy"></a> [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 | <a name="input_attach_elb_log_delivery_policy"></a> [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+| <a name="input_attach_lb_log_delivery_policy"></a> [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 | <a name="input_attach_policy"></a> [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 | <a name="input_attach_public_policy"></a> [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 | <a name="input_block_public_acls"></a> [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/README.md
@@ -2,7 +2,7 @@

 Configuration in this directory creates S3 bucket which demos such capabilities:
 - static web-site hosting
-- access logging (for S3 and ELB)
+- access logging (for S3, ELB and ALB/NLB)
 - versioning
 - CORS
 - lifecycle rules
---
examples/complete/main.tf
@@ -55,6 +55,7 @@ module "log_bucket" {
   acl                                   = "log-delivery-write"
   force_destroy                         = true
   attach_elb_log_delivery_policy        = true
+  attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
 }

---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# ALB/NLB
+
+data "aws_iam_policy_document" "lb_log_delivery" {
+  count = var.create_bucket && var.attach_lb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_lb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have ALB/NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---
wrappers/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

---
wrappers/main.tf
@@ -5,6 +5,7 @@ module "wrapper" {

   create_bucket                         = lookup(each.value, "create_bucket", true)
   attach_elb_log_delivery_policy        = lookup(each.value, "attach_elb_log_delivery_policy", false)
+  attach_lb_log_delivery_policy         = lookup(each.value, "attach_lb_log_delivery_policy", false)
   attach_deny_insecure_transport_policy = lookup(each.value, "attach_deny_insecure_transport_policy", false)
   attach_policy                         = lookup(each.value, "attach_policy", false)
   attach_public_policy                  = lookup(each.value, "attach_public_policy", true)
---

---

Choice D:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket -5,6 ALB/NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with ALB/NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_lb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -113,6 +130,7 @@ No modules.
 | [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -122,6 +140,7 @@ No modules.
 |  [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 |  [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 |  [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+|  [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/README.md
@@ -2,7 +2,7 @@

 Configuration in this directory creates S3 bucket which demos such capabilities:
 - static web-site hosting
-- access logging (for S3 and ELB)
+- access logging (for S3, ELB and ALB/NLB)
 - versioning
 - CORS
 - lifecycle rules
---
examples/complete/main.tf
@@ -55,6 +55,7 @@ module "log_bucket" {
   acl                                   = "log-delivery-write"
   force_destroy                         = true
   attach_elb_log_delivery_policy        = true
+  attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
 }

---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# ALB/NLB
+
+data "aws_iam_policy_document" "lb_log_delivery" {
+  count = var.create_bucket && var.attach_lb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values   = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_lb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have ALB/NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---
wrappers/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

---
wrappers/main.tf
@@ -5,6 +5,7 @@ module "wrapper" {

   create_bucket                         = lookup(each.value, "create_bucket", true)
   attach_elb_log_delivery_policy        = lookup(each.value, "attach_elb_log_delivery_policy", false)
+  attach_lb_log_delivery_policy         = lookup(each.value, "attach_lb_log_delivery_policy", false)
   attach_deny_insecure_transport_policy = lookup(each.value, "attach_deny_insecure_transport_policy", false)
   attach_policy                         = lookup(each.value, "attach_policy", false)
   attach_public_policy                  = lookup(each.value, "attach_public_policy", true)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Fixes #93

Any comments are welcome.

---

Choice A:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_nlb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -122,6 +139,7 @@ No modules.
 | <a name="input_acl"></a> [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 | <a name="input_attach_deny_insecure_transport_policy"></a> [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 | <a name="input_attach_elb_log_delivery_policy"></a> [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+| <a name="input_attach_nlb_log_delivery_policy"></a> [attach\_nlb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have NLB log delivery policy attached | `bool` | `false` | no |
 | <a name="input_attach_policy"></a> [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 | <a name="input_attach_public_policy"></a> [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 | <a name="input_block_public_acls"></a> [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_nlb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_nlb_log_delivery_policy ? data.aws_iam_policy_document.nlb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# NLB
+
+data "aws_iam_policy_document" "nlb_log_delivery" {
+  count = var.create_bucket && var.attach_nlb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test  = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    |
 {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_nlb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---

---

Choice B:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_nlb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -122,6 +139,7 @@ No modules.
 |  [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 |  [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 |  [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+|  [attach\_nlb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_nlb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_nlb_log_delivery_policy ? data.aws_iam_policy_document.nlb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   +49,22 -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# NLB
+
+data "aws_iam_policy_document" "nlb_log_delivery" {
+  count = var.create_bucket && var.attach_nlb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test  = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_nlb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---

---

Choice C:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_nlb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -122,6 +139,7 @@ No modules.
 | <a name="input_acl"></a> [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 | <a name="input_attach_deny_insecure_transport_policy"></a> [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 | <a name="input_attach_elb_log_delivery_policy"></a> [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+| <a name="input_attach_nlb_log_delivery_policy"></a> [attach\_nlb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have NLB log delivery policy attached | `bool` | `false` | no |
 | <a name="input_attach_policy"></a> [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 | <a name="input_attach_public_policy"></a> [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 | <a name="input_block_public_acls"></a> [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_nlb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_nlb_log_delivery_policy ? data.aws_iam_policy_document.nlb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# NLB
+
+data "aws_iam_policy_document" "nlb_log_delivery" {
+  count = var.create_bucket && var.attach_nlb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    delivery    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test  = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_nlb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---

---

Choice D:
README.md
@@ -13,6 +13,7 @@ These features of S3 bucket configurations are supported:
 - object locking
 - Cross-Region Replication (CRR)
 - ELB log delivery bucket policy
+- NLB log delivery bucket policy

 ## Usage

@@ -48,6 +49,22 @@ module "s3_bucket_for_logs" {
 }
 ```

+### Bucket with NLB access log delivery policy attached
+
+```hcl
+module "s3_bucket_for_logs" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  bucket = "my-s3-bucket-for-logs"
+  acl    = "log-delivery-write"
+
+  # Allow deletion of non-empty bucket
+  force_destroy = true
+
+  attach_nlb_log_delivery_policy = true
+}
+```
+
 ## Conditional creation

 Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`.
@@ -122,6 +139,7 @@ No modules.
 |  [acl](#input\_acl) | (Optional) The canned ACL to apply. Defaults to 'private'. Conflicts with `grant` | `string` | `"private"` | no |
 |  [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
 |  [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
+|  [attach\_nlb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_elb_log_delivery_policy || var.attach_nlb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -247,6 +247,7 @@ data "aws_iam_policy_document" "combined" {

   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
+    var.attach_nlb_log_delivery_policy ? data.aws_iam_policy_document.nlb_log_delivery[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -280,6 +281,57 @@ data "aws_iam_policy_document" "elb_log_delivery" {
   }
 }

+# NLB
+
+data "aws_iam_policy_document" "nlb_log_delivery" {
+  count = var.create_bucket && var.attach_nlb_log_delivery_policy ? 1 : 0
+
+  statement {
+    sid = "AWSLogDeliveryWrite"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    condition {
+      test  = "StringEquals"
+      variable = "s3:x-amz-acl"
+      values = ["bucket-owner-full-control"]
+    }
+  }
+
+  statement {
+    sid = "AWSLogDeliveryAclCheck"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["delivery.logs.amazonaws.com"]
+    }
+
+    actions = [
+      "s3:GetBucketAcl",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.this[0].arn}",
+    ]
+
+  }
+}
+
 data "aws_iam_policy_document" "deny_insecure_transport" {
   count = var.create_bucket && var.attach_deny_insecure_transport_policy ? 1 : 0

---
variables.tf
@@ -10,6 +10,12 @@ variable "attach_elb_log_delivery_policy" {
   default     = false
 }

+variable "attach_nlb_log_delivery_policy" {
+  description = "Controls if S3 bucket should have NLB log delivery policy attached"
+  type        = bool
+  default     = false
+}
+
 variable "attach_deny_insecure_transport_policy" {
   description = "Controls if S3 bucket should have deny non-SSL transport policy attached"
   type        = bool
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
```
export TF_LOG=DEBUG
terraform test # using Terraform 0.15
```

Last output before it freezes:
```
2021-04-22T15:58:08.661+0200 [INFO]  Starting apply for module.complete.aws_s3_bucket_policy.this[0]
2021-04-22T15:58:08.662+0200 [DEBUG] module.complete.aws_s3_bucket_policy.this[0]: applying the planned Create change
2021-04-22T15:58:08.663+0200 [INFO]  provider.terraform-provider-aws_v3.37.0_x5: 2021/04/22 15:58:08 [DEBUG] S3 bucket: logs-optimum-llama, put policy: {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::logs-optimum-llama/*",
      "Principal": {
        "AWS": []
      }
    },
    {
      "Sid": "denyInsecureTransport",
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::logs-optimum-llama/*",
        "arn:aws:s3:::logs-optimum-llama"
      ],
      "Principal": "*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": [
            "false"
          ]
        }
      }
    }
  ]
}: timestamp=2021-04-22T15:58:08.663+0200
2021-04-22T15:58:08.663+0200 [INFO]  provider.terraform-provider-aws_v3.37.0_x5: 2021/04/22 15:58:08 [DEBUG] Waiting for state to become: [success]: timestamp=2021-04-22T15:58:08.663+0200
2021-04-22T15:59:08.668+0200 [INFO]  provider.terraform-provider-aws_v3.37.0_x5: 2021/04/22 15:59:08 [WARN] WaitForState timeout after 1m0s: timestamp=2021-04-22T15:59:08.668+0200
2021-04-22T15:59:08.668+0200 [INFO]  provider.terraform-provider-aws_v3.37.0_x5: 2021/04/22 15:59:08 [WARN] WaitForState starting 30s refresh grace period: timestamp=2021-04-22T15:59:08.668+0200
2021-04-22T15:59:38.671+0200 [INFO]  provider.terraform-provider-aws_v3.37.0_x5: 2021/04/22 15:59:38 [ERROR] WaitForState exceeded refresh grace period: timestamp=2021-04-22T15:59:38.671+0200
```

---

Choice A:
tests/complete/test_complete.tf
@@ -0,0 +1,19 @@
+locals {
+  bucket_name = "s3-bucket-${random_pet.this.id}"
+}
+
+data "aws_canonical_user_id" "current" {}
+
+resource "random_pet" "this" {
+  length = 2
+}
+
+module "complete" {
+  source = "../../"
+
+  bucket                                = "logs-${random_pet.this.id}"
+  acl                                   = "log-delivery-write"
+  force_destroy                         = true
+  attach_elb_log_delivery_policy        = true
+  attach_deny_insecure_transport_policy = true
+}
---

---

Choice B:
tests/complete/test_complete.tf
@@ -0,0 +1,19 @@
+locals {
+  bucket_name = "s3-bucket-${random_pet.this.id}"
+}
+
+data "aws_canonical_user_id" "current" {}
+
+resource "random_pet" "this" {
+  length = 2
+}
+
+module "complete" {
+  source = "../../"
+
+  bucket                                = "logs-${random_pet.this.id}"
+  acl                                   = "log-delivery-write"
+  force_destroy                         = true
+  attach_elb_log_delivery_policy        = true
+  attach_deny_insecure_transport_policy = true
+}
---

---

Choice C:
tests/complete/test_complete.tf
@@ -0,0 +1,19 @@
+locals {
+  bucket_name = "s3-bucket-${random_pet.this.id}"
+}
+
+data "aws_canonical_user_id" "current" {}
+
+resource "random_pet" "this" {
+  length = 2
+}
+
+module "complete" {
+  source = "../../"
+
+  bucket                                = "logs-${random_pet.this.id}"
+  acl                                   = "log-delivery-write"
+  force_destroy                         = true
+  attach_elb_log_delivery_policy        = true
+  attach_deny_insecure_transport_policy = true
+}
---

---

Choice D:
tests/complete/test_complete.tf
@@ -0,0 +1,19 @@
+locals {
+  bucket_name = "s3-bucket-${random_pet.this.id}"
+}
+
+data "aws_canonical_user_id" "current" {}
+
+resource "random_pet" "this" {
+  length = 2
+}
+
+module "complete" {
+  source = "../../"
+
+  bucket                                = "logs-${random_pet.this.id}"
+  acl                                   = "log-delivery-write"
+  force_destroy                         = true
+  attach_elb_log_delivery_policy        = true
+  attach_deny_insecure_transport_policy = true
+}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Fixes #78

Issue in terragrunt - https://github.com/gruntwork-io/terragrunt/issues/1211

---

Choice A:
README.md
@@ -69,6 +69,22 @@ module "s3_bucket" {
 }
 ```

+## Terragrunt and `variable "..." { type = any }`
+
+There is a bug [#1211](https://github.com/gruntwork-io/terragrunt/issues/1211) in Terragrunt related to the way how the variables of type `any` are passed to Terraform.
+
+This module solves this issue by supporting `jsonencode()`-string in addition to the expected type (`list` or `map`).
+
+In `terragrunt.hcl` you can write:
+
+```terraform
+inputs = {
+  bucket    = "foobar"            # `bucket` has type `string`, no need to jsonencode()
+  cors_rule = jsonencode([...])   # `cors_rule` has type `any`, so `jsonencode()` is required
+}
+```
+
+
 ## Examples:

 * [Complete](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) - Complete S3 bucket with most of supported features enabled
---
main.tf
@@ -28,7 +28,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = var.cors_rule
+    for_each = try(jsondecode(var.cors_rule), var.cors_rule)

     content {
       allowed_methods = cors_rule.value.allowed_methods
@@ -58,7 +58,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "grant" {
-    for_each = var.grant
+    for_each = try(jsondecode(var.grant), var.grant)

 `bucket`    content {
       id          = lookup(grant.value, "id", null)
@@ -69,7 +69,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "lifecycle_rule" {
-    for_each = var.lifecycle_rule
+    for_each = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)

     content {
       id                                     = lookup(lifecycle_rule.value, "id", null)
---

---

Choice B:
README.md
@@ -69,6 +69,22 @@ module "s3_bucket" {
 }
 ```

+## Terragrunt and `variable "..." { type = any }`
+
+There is a bug [#1211](https://github.com/gruntwork-io/terragrunt/issues/1211) in Terragrunt related to the way how the variables of type `any` are passed to Terraform.
+
+This module solves this issue by supporting `jsonencode()`-string in addition to the expected type (`list` or `map`).
+
+In `terragrunt.hcl` you can write:
+
+```terraform
+inputs = {
+  bucket    = "foobar"            # `bucket` has type `string`, no need to jsonencode()
+  cors_rule = jsonencode([...])   # `cors_rule` has type `any`, so `jsonencode()` is required
+}
+```
+
+
 ## Examples:

 * [Complete](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) - Complete S3 bucket with most of supported features enabled
---
main.tf
@@ -28,7 +28,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = var.cors_rule
+    for_each = try(jsondecode(var.cors_rule), var.cors_rule)

     content {
       allowed_methods = cors_rule.value.allowed_methods
@@ -58,7 +58,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "grant" {
-    for_each = var.grant
+    for_each = try(jsondecode(var.grant), var.grant)

     "this" {
       id          = lookup(grant.value, "id", null)
@@ -69,7 +69,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "lifecycle_rule" {
-    for_each = var.lifecycle_rule
+    for_each = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)

     content {
       id                                     = lookup(lifecycle_rule.value, "id", null)
---

---

Choice C:
README.md
@@ -69,6 +69,22 @@ module "s3_bucket" {
 }
 ```

+## Terragrunt and `variable "..." { type = any }`
+
+There is a bug [#1211](https://github.com/gruntwork-io/terragrunt/issues/1211) in Terragrunt related to the way how the variables of type `any` are passed to Terraform.
+
+This module solves this issue by supporting `jsonencode()`-string in addition to the expected type (`list` or `map`).
+
+In `terragrunt.hcl` you can write:
+
+```terraform
+inputs = {
+  bucket    = "foobar"            # `bucket` has type `string`, no need to jsonencode()
+  cors_rule = jsonencode([...])   # `cors_rule` has type `any`, so `jsonencode()` is required
+}
+```
+
+
 ## Examples:

 * [Complete](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) - Complete S3 bucket with most of supported features enabled
---
main.tf
@@ -28,7 +28,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = var.cors_rule
+    for_each = try(jsondecode(var.cors_rule), var.cors_rule)

     content {
       allowed_methods = cors_rule.value.allowed_methods
@@ -58,7 +58,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "grant" {
-    for_each = var.grant
+    for_each = try(jsondecode(var.grant), var.grant)

     content {
       id          = lookup(grant.value, "id", null)
@@ -69,7 +69,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "lifecycle_rule" {
-    for_each = var.lifecycle_rule
+    for_each = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)

    @@ content {
       id                                     = lookup(lifecycle_rule.value, "id", null)
---

---

Choice D:
README.md
@@ -69,6 +69,22 @@ module "s3_bucket" {
 }
 ```

+## Terragrunt and `variable "..." { type = any }`
+
+There is a bug [#1211](https://github.com/gruntwork-io/terragrunt/issues/1211) in Terragrunt related to the way how the variables of type `any` are passed to Terraform.
+
+This module solves this issue by supporting `jsonencode()`-string in addition to the expected type (`list` or `map`).
+
+In `terragrunt.hcl` you can write:
+
+```terraform
+inputs = {
+  bucket    = "foobar"            # `bucket` has type `string`, no need to jsonencode()
+  cors_rule = jsonencode([...])   # `cors_rule` has type `any`, so `jsonencode()` is required
+}
+```
+
+
 ## Examples:

 * [Complete](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) - Complete S3 bucket with most of supported features enabled
---
main.tf
@@ -28,7 +28,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = var.cors_rule
+    for_each = try(jsondecode(var.cors_rule), var.cors_rule)

     content {
       allowed_methods = cors_rule.value.allowed_methods
@@ -58,7 +58,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "grant" {
-    for_each = var.grant
+    for_each = try(jsondecode(var.grant), var.grant)

     content {
       id          = lookup(grant.value, "id", null)
@@ -69,7 +69,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "lifecycle_rule" {
-    for_each = var.lifecycle_rule
+    for_each = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)

     content {
       id                                     = lookup(lifecycle_rule.value, "id", null)
---

---