Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Removed s3_bucket_ suffixes from all points in output from README.

## Motivation and Context
s3_bucket_ suffixes do not exist anymore

## Breaking Changes
Not known

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [ ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -212,14 +212,14 @@ No modules.

 | Name | Description |
 |------|-------------|
-|  [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
-|  [s3\_bucket\_bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
-|  [s3\_bucket\_bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
-|  [s3\_bucket\_hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
-|  [s3\_bucket\_id](#output\_s3\_bucket\_id) | The name of the bucket. |
-|  [s3\_bucket\_region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
-|  [s3\_bucket\_website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
-|  [s3\_bucket\_website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, a the bucket is configured with a website. If not, this will be an empty string. |
+|  [arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
+|  [bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
+|  [bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
+|  [hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
+|  [id](#output\_s3\_bucket\_id) | The name of the bucket. |
+|  [region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
+|  [website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
+|  [website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |

 ## Authors
---

---

Choice B:
README.md
@@ -212,14 +212,14 @@ No modules.

 | Name | Description |
 |------|-------------|
-|  [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
-|  [s3\_bucket\_bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
-|  [s3\_bucket\_bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
-|  [s3\_bucket\_hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
-|  [s3\_bucket\_id](#output\_s3\_bucket\_id) | The name of the bucket. |
-|  [s3\_bucket\_region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
-|  [s3\_bucket\_website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
-|  [s3\_bucket\_website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |
+|  [arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
+|  [bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
+|  [bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
+|  [hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
+|  [id](#output\_s3\_bucket\_id) | The name of the bucket. |
+|  [region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
+|  [website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
+|  [website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |

 ## Authors
---

---

Choice C:
README.md
@@ -212,14 +212,14 @@ No modules.

 | Name | Description |
 |------|-------------|
-|  [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
-|  [s3\_bucket\_bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
-|  [s3\_bucket\_bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
-|  [s3\_bucket\_hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
-|  [s3\_bucket\_id](#output\_s3\_bucket\_id) | The name of the bucket. |
-|  [s3\_bucket\_region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
-|  [s3\_bucket\_website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
-|  [s3\_bucket\_website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |
+|  [arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
+|  [bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
+|  [bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
+|  [hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
+|  [id](#output\_s3\_bucket\_id) | The name of the bucket. |
+|  [region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
+|  [website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to name Route 53 alias records. |
+|  [website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |

 ## Authors
---

---

Choice D:
README.md
@@ -212,14 +212,14 @@ No modules.

 | Name | Description |
 |------|-------------|
-|  [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
-|  [s3\_bucket\_bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain | Will be of format bucketname.s3.amazonaws.com. |
-|  [s3\_bucket\_bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
-|  [s3\_bucket\_hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
-|  [s3\_bucket\_id](#output\_s3\_bucket\_id) | The name of the bucket. |
-|  [s3\_bucket\_region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
-|  [s3\_bucket\_website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
-|  [s3\_bucket\_website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |
+|  [arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
+|  [bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
+|  [bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
+|  [hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
+|  [id](#output\_s3\_bucket\_id) | The name of the bucket. |
+|  [region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
+|  [website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
+|  [website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |

 ## Authors
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Enable jsonencode support for replication config

## Motivation and Context

```
locals {
  replication_config = jsonencode({
    role = var.role_arn
    rules = [
      {
        id       = "sync to staging"
        status   = true
        priority = 0

        delete_marker_replication = true

        destination = {
          bucket     = "arn:aws:s3:::test2"
          account_id = "xxxxxx"
          access_control_translation = {
            owner = "Destination"
          }
        }
      },
    ]
  })
}

module "bucket" {
  source                  = "terraform-aws-modules/s3-bucket/aws"
  version                 = "3.6.x"
  bucket                  = "test"
  replication_configuration = var.env == "prod" ? local.replication_config : "{}"
}
```

## Breaking Changes

No.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -8,11 +8,12 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_inventory_destination_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants               = try(jsondecode(var.grant), var.grant)
-  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
-  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  grants   ?                 = try(jsondecode(var.grant), var.grant)
+  cors_rules                = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules           = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering       = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration      = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  replication_configuration = try(jsondecode(var.replication_configuration), var.replication_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -338,13 +339,13 @@ resource "aws_s3_bucket_object_lock_configuration" "this" {
 }

 resource "aws_s3_bucket_replication_configuration" "this" {
-  count = local.create_bucket && length(keys(var.replication_configuration)) > 0 ? 1 : 0
+  count = local.create_bucket && length(keys(local.replication_configuration)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id
-  role   = var.replication_configuration["role"]
+  role   = local.replication_configuration["role"]

   dynamic "rule" {
-    for_each = flatten(try([var.replication_configuration["rule"]], [var.replication_configuration["rules"]], []))
+    for_each = flatten(try([local.replication_configuration["rule"]], [local.replication_configuration["rules"]], []))

     content {
       id       = try(rule.value.id, null)
---

---

Choice B:
main.tf
@@ -8,11 +8,12 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_inventory_destination_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants               = try(jsondecode(var.grant), var.grant)
-  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
-  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  grants                    = try(jsondecode(var.grant), var.grant)
+  cors_rules                = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules           = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering       = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration      = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  replication_configuration = try(jsondecode(var.replication_configuration), var.replication_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -338,13 +339,13 @@ resource "aws_s3_bucket_object_lock_configuration" "this" {
 }

 resource "aws_s3_bucket_replication_configuration" "this" {
-  count = local.create_bucket && length(keys(var.replication_configuration)) > 0 ? 1 : 0
+  count = local.create_bucket && length(keys(local.replication_configuration)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id
-  role   = var.replication_configuration["role"]
+  role   = local.replication_configuration["role"]

   dynamic "rule" {
-    for_each = flatten(try([var.replication_configuration["rule"]], [var.replication_configuration["rules"]], []))
+    for_each = flatten(try([local.replication_configuration["rule"]], [local.replication_configuration["rules"]], []))

     content {
       id       = try(rule.value.id, null)
---

---

Choice C:
main.tf
@@ -8,11 +8,12 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_inventory_destination_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants               = try(jsondecode(var.grant), var.grant)
-  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
-  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  grants                    = try(jsondecode(var.grant), var.grant)
+  cors_rules                = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules           = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering       = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration      = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  replication_configuration = try(jsondecode(var.replication_configuration), var.replication_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -338,13 +339,13 @@ resource "aws_s3_bucket_object_lock_configuration" "this" {
 }

 resource "aws_s3_bucket_replication_configuration" "this" {
-  count = local.create_bucket && length(keys(var.replication_configuration)) > 0 ? 1 : 0
+  count = local.create_bucket && length(keys(local.replication_configuration)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id
-  role   = var.replication_configuration["role"]
+  role   = local.replication_configuration["role"]

   dynamic "rule" {
-    for_each = flatten(try([var.replication_configuration["rule"]], [var.replication_configuration["rules"]], []))
+    for_each = flatten(try([local.replication_configuration["rule"]], [local.replication_configuration["rules"]], []))

     content {
       id       = try(rule.value.id, null)
---

---

Choice D:
main.tf
@@ -8,11 +8,12 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_inventory_destination_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants               = try(jsondecode(var.grant), var.grant)
-  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
-  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  grants                    = try(jsondecode(var.grant), var.grant)
+  cors_rules                = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules           = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering       = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration      = try(jsondecode(var.metric_configuration), var.metric_configuration)
+  replication_configuration = try(jsondecode(var.replication_configuration), var.replication_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ try(jsondecode(var.grant), +339,13 @@ resource "aws_s3_bucket_object_lock_configuration" "this" {
 }

 resource "aws_s3_bucket_replication_configuration" "this" {
-  count = local.create_bucket && length(keys(var.replication_configuration)) > 0 ? 1 : 0
+  count = local.create_bucket && length(keys(local.replication_configuration)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id
-  role   = var.replication_configuration["role"]
+  role   = local.replication_configuration["role"]

   dynamic "rule" {
-    for_each = flatten(try([var.replication_configuration["rule"]], [var.replication_configuration["rules"]], []))
+    for_each = flatten(try([local.replication_configuration["rule"]], [local.replication_configuration["rules"]], []))

     content {
       id       = try(rule.value.id, null)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adds bucket metrics support.

## Motivation and Context
Fixes https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/187

## Breaking Changes
No.

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -184,6 +185,7 @@ No modules.
 |  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
+|  [metric\_configuration](#input\_metric\_configuration) | Map containing bucket metric configuration. | `any` | `[]` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
 |  [object\_lock\_enabled](#input\_object\_lock\_enabled) | Whether S3 bucket should have an Object Lock configuration enabled. | `bool` | `false` | no |
 |  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
---
examples/complete/main.tf
@@ -324,4 +324,28 @@ module "s3_bucket" {
       }
     }
   }
+
+  metric_configuration = [
+    {
+      name = "documents"
+      filter = {
+        prefix = "documents/"
+        tags = {
+          priority = "high"
+        }
+      }
+    },
+    {
+      name = "other"
+      filter = {
+        tags = {
+          production = "true"
+        }
+      }
+    },
+    {
+      name = "all"
+    }
+  ]
+
 }
---
main.tf
@@ -6,10 +6,11 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants              = try(jsondecode(var.grant), var.grant)
-  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  grants               = try(jsondecode(var.grant), var.grant)
+  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -719,3 +720,18 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   }

 }
+
+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in local.metric_configuration : k => v if local.create_bucket }
+
+  name   = each.value.name
+  bucket = aws_s3_bucket.this[0].id
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+}
---
variables.tf
@@ -160,6 +160,12 @@ variable "object_lock_configuration" {
   default     = {}
 }

+variable "metric_configuration" {
+  description = "Map containing bucket metric configuration."
+  type        = any
+  default     = []
+}
+
 variable "object_lock_enabled" {
   description = "Whether S3 bucket should have an Object Lock configuration enabled."
   type        = bool
---
wrappers/main.tf
@@ -30,6 +30,7 @@ module "wrapper" {
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
   intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
+  metric_configuration                  = try(each.value.metric_configuration, var.defaults.metric_configuration, [])
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
   block_public_policy                   = try(each.value.block_public_policy, var.defaults.block_public_policy, false)
---

---

Choice B:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -184,6 +185,7 @@ No modules.
 |  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
+|  [metric\_configuration](#input\_metric\_configuration) | Map containing bucket metric configuration. | `any` | `[]` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
 values:  [object\_lock\_enabled](#input\_object\_lock\_enabled) | Whether S3 bucket should have an Object Lock configuration enabled. | `bool` | `false` | no |
 |  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
---
examples/complete/main.tf
@@ -324,4 +324,28 @@ module "s3_bucket" {
       }
     }
   }
+
+  metric_configuration = [
+    {
+      name = "documents"
+      filter = {
+        prefix = "documents/"
+        tags = {
+          priority = "high"
+        }
+      }
+    },
+    {
+      name = "other"
+      filter = {
+        tags = {
+          production = "true"
+        }
+      }
+    },
+    {
+      name = "all"
+    }
+  ]
+
 }
---
main.tf
@@ -6,10 +6,11 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants              = try(jsondecode(var.grant), var.grant)
-  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  grants               = try(jsondecode(var.grant), var.grant)
+  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -719,3 +720,18 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   }

 }
+
+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in local.metric_configuration : k => v if local.create_bucket }
+
+  name   = each.value.name
+  bucket = aws_s3_bucket.this[0].id
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+}
---
variables.tf
@@ -160,6 +160,12 @@ variable "object_lock_configuration" {
   default     = {}
 }

+variable "metric_configuration" {
+  description = "Map containing bucket metric configuration."
+  type        = any
+  default     = []
+}
+
 variable "object_lock_enabled" {
   description = "Whether S3 bucket should have an Object Lock configuration enabled."
   type        = bool
---
wrappers/main.tf
@@ -30,6 +30,7 @@ module "wrapper" {
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
   intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
+  metric_configuration                  = try(each.value.metric_configuration, var.defaults.metric_configuration, [])
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
   block_public_policy                   = try(each.value.block_public_policy, var.defaults.block_public_policy, false)
---

---

Choice C:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration)  resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -184,6 +185,7 @@ No modules.
 |  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
+|  [metric\_configuration](#input\_metric\_configuration) | Map containing bucket metric configuration. | `any` | `[]` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
 |  [object\_lock\_enabled](#input\_object\_lock\_enabled) | Whether S3 bucket should have an Object Lock configuration enabled. | `bool` | `false` | no |
 |  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
---
examples/complete/main.tf
@@ -324,4 +324,28 @@ module "s3_bucket" {
       }
     }
   }
+
+  metric_configuration = [
+    {
+      name = "documents"
+      filter = {
+        prefix = "documents/"
+        tags = {
+          priority = "high"
+        }
+      }
+    },
+    {
+      name = "other"
+      filter = {
+        tags = {
+          production = "true"
+        }
+      }
+    },
+    {
+      name = "all"
+    }
+  ]
+
 }
---
main.tf
@@ -6,10 +6,11 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants              = try(jsondecode(var.grant), var.grant)
-  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  grants               = try(jsondecode(var.grant), var.grant)
+  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -719,3 +720,18 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   }

 }
+
+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in local.metric_configuration : k => v if local.create_bucket }
+
+  name   = each.value.name
+  bucket = aws_s3_bucket.this[0].id
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+}
---
variables.tf
@@ -160,6 +160,12 @@ variable "object_lock_configuration" {
   default     = {}
 }

+variable "metric_configuration" {
+  description = "Map containing bucket metric configuration."
+  type        = any
+  default     = []
+}
+
 variable "object_lock_enabled" {
   description = "Whether S3 bucket should have an Object Lock configuration enabled."
   type        = bool
---
wrappers/main.tf
@@ -30,6 +30,7 @@ module "wrapper" {
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
   intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
+  metric_configuration                  = try(each.value.metric_configuration, var.defaults.metric_configuration, [])
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
   block_public_policy                   = try(each.value.block_public_policy, var.defaults.block_public_policy, false)
---

---

Choice D:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource  [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -184,6 +185,7 @@ No modules.
 |  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
+|  [metric\_configuration](#input\_metric\_configuration) | Map containing bucket metric configuration. | `any` | `[]` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
 |  [object\_lock\_enabled](#input\_object\_lock\_enabled) | Whether S3 bucket should have an Object Lock configuration enabled. | `bool` | `false` | no |
 |  [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no |
---
examples/complete/main.tf
@@ -324,4 +324,28 @@ module "s3_bucket" {
       }
     }
   }
+
+  metric_configuration = [
+    {
+      name = "documents"
+      filter = {
+        prefix = "documents/"
+        tags = {
+          priority = "high"
+        }
+      }
+    },
+    {
+      name = "other"
+      filter = {
+        tags = {
+          production = "true"
+        }
+      }
+    },
+    {
+      name = "all"
+    }
+  ]
+
 }
---
main.tf
@@ -6,10 +6,11 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants              = try(jsondecode(var.grant), var.grant)
-  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
-  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  grants               = try(jsondecode(var.grant), var.grant)
+  cors_rules           = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules      = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering  = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
+  metric_configuration = try(jsondecode(var.metric_configuration), var.metric_configuration)
 }

 resource "aws_s3_bucket" "this" {
@@ -719,3 +720,18 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   }

 }
+
+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in local.metric_configuration : k => v if local.create_bucket }
+
+  name   = each.value.name
+  bucket = aws_s3_bucket.this[0].id
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+}
---
variables.tf
@@ -160,6 +160,12 @@ variable "object_lock_configuration" {
   default     = {}
 }

+variable "metric_configuration" {
+  description = "Map containing bucket metric configuration."
+  type        = any
+  default     = []
+}
+
 variable "object_lock_enabled" {
   description = "Whether S3 bucket should have an Object Lock configuration enabled."
   type        = bool
---
wrappers/main.tf
@@ -30,6 +30,7 @@ module "wrapper" {
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
   intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
+  metric_configuration                  = try(each.value.metric_configuration, var.defaults.metric_configuration, [])
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
   block_public_policy                   = try(each.value.block_public_policy, var.defaults.block_public_policy, false)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This PR removes deprecated attributes from the `aws_s3_bucket` resource. This required a change to the required AWS provider version, version `4.9.0` made the removed attributes optional - this module uses the standalone resources.

I also updated one of the examples as the hard-coded value caused errors when testing.

Fixes https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/174
Fixes https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/177
Fixes https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/176

## Motivation and Context
Prior to this change, Terraform shows `Warning: Deprecated attribute` when running an apply. This no longer happens with these changes.

This fixes https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/174 and https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/177

## Breaking Changes
There are no breaking changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
  - A fix was applied to the `complete` example
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
  - The `complete` example was used
- [x] I have executed `pre-commit run -a` on my pull request

As mentioned above, I use the `complete` example to show the behaviour before and after these changes. This example required removing a hardcoded canonical ID to get it to deploy before any changes had been made.

---

Choice A:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.71.0
+    rev: v1.74.1
     hooks:
       - id: terraform_fmt
       - id: terraform_wrapper_module_for_each
@@ -24,7 +24,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
README.md
@@ -118,13 +118,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |

 ## Modules

---
examples/complete/README.md
@@ -30,14 +30,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/main.tf
@@ -95,7 +95,7 @@ module "cloudfront_log_bucket" {
   ]

   owner = {
-    id = "457414f555e45c2e6fe1069d1a527a90d6337e1acb012ba99f3833859b23d338"
+    id = data.aws_canonical_user_id.current.id
   }

   force_destroy = true
---
examples/complete/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       name="provider_random">  = "hashicorp/random"
---
examples/notification/README.md
@@ -20,15 +20,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
-|  [aws.replica](#provider\_aws.replica) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
+|  [aws.replica](#provider\_aws.replica) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
   }
 }
---

---

Choice B:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.71.0
+    rev: v1.74.1
     hooks:
       - id: terraform_fmt
       - id: terraform_wrapper_module_for_each
@@ -24,7 +24,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
README.md
@@ -118,13 +118,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |

 ## Modules

---
examples/complete/README.md
@@ -30,14 +30,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/main.tf
@@ -95,7 +95,7 @@ module "cloudfront_log_bucket" {
   ]

   owner = {
-    id = "457414f555e45c2e6fe1069d1a527a90d6337e1acb012ba99f3833859b23d338"
+    id = data.aws_canonical_user_id.current.id
   }

   force_destroy = true
---
examples/complete/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/notification/README.md
@@ -20,15 +20,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws)  >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
-|  [aws.replica](#provider\_aws.replica) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
+|  [aws.replica](#provider\_aws.replica) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
   }
 }
---

---

Choice C:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.71.0
+    rev: v1.74.1
     hooks:
       - id: terraform_fmt
       - id: terraform_wrapper_module_for_each
@@ -24,7 +24,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
README.md
@@ -118,13 +118,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |

 ## Modules

---
examples/complete/README.md
@@ -30,14 +30,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/main.tf
@@ -95,7 +95,7 @@ module "cloudfront_log_bucket" {
   ]

   owner = {
-    id = "457414f555e45c2e6fe1069d1a527a90d6337e1acb012ba99f3833859b23d338"
+    id = data.aws_canonical_user_id.current.id
   }

   force_destroy = true
---
examples/complete/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/notification/README.md
@@ -20,15 +20,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
-|  [aws.replica](#provider\_aws.replica) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
+|  [aws.replica](#provider\_aws.replica) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
   }
 }
---

---

Choice D:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.71.0
+    rev: v1.74.1
     hooks:
       - id: terraform_fmt
       - id: terraform_wrapper_module_for_each
@@ -24,7 +24,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
README.md
@@ -118,13 +118,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |

 ## Modules

---
examples/complete/README.md
@@ -30,14 +30,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/main.tf
@@ -95,7 +95,7 @@ module "cloudfront_log_bucket" {
   ]

   owner = {
-    id = "457414f555e45c2e6fe1069d1a527a90d6337e1acb012ba99f3833859b23d338"
+    id = data.aws_canonical_user_id.current.id
   }

   force_destroy = true
---
examples/complete/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/notification/README.md
@@ -20,15 +20,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 4.5 |
+|  [aws](#requirement\_aws) | >= 4.9 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 4.5 |
-|  [aws.replica](#provider\_aws.replica) | >= 4.5 |
+|  [aws](#provider\_aws) | >= 4.9 |
+|  [aws.replica](#provider\_aws.replica) | >= 4.9 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
     random = {
       source  = "hashicorp/random"
---
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.5"
+      version = ">= 4.9"
     }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description

I added the source_hash parameter for the S3 bucket object.
Fixes #171

## Motivation and Context

> Attribute etag is not compatible with KMS encryption, so I can`t use it during update of uploaded file via terraform. Need to use attribute source_hash instead etag, but this attribute is missing in current object module.

## Breaking Changes

No breaking change.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
modules/object/README.md
@@ -51,6 +51,7 @@ object. modules.
 |  [object\_lock\_mode](#input\_object\_lock\_mode) | The object lock retention mode that you want to apply to this object. Valid values are GOVERNANCE and COMPLIANCE. | `string` | `null` | no |
 |  [object\_lock\_retain\_until\_date](#input\_object\_lock\_retain\_until\_date) | The date and time, in RFC3339 format, when this object's object lock will expire. | `string` | `null` | no |
 |  [server\_side\_encryption](#input\_server\_side\_encryption) | Specifies server-side encryption of the object in S3. Valid values are "AES256" and "aws:kms". | `string` | `null` | no |
+|  [source\_hash](#input\_source\_hash) | Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5("path/to/source") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.) | `string` | `null` | no |
 |  [storage\_class](#input\_storage\_class) | Specifies the desired Storage Class for the object. Can be either STANDARD, REDUCED\_REDUNDANCY, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, DEEP\_ARCHIVE, or STANDARD\_IA. Defaults to STANDARD. | `string` | `null` | no |
 |  [tags](#input\_tags) | A map of tags to assign to the object. | `map(string)` | `{}` | no |
 |  [website\_redirect](#input\_website\_redirect) | Specifies a target URL for website redirect. | `string` | `null` | no |
---
modules/object/main.tf
@@ -29,6 +29,8 @@ resource "aws_s3_object" "this" {
   object_lock_mode              = try(upper(var.object_lock_mode), var.object_lock_mode)
   object_lock_retain_until_date = var.object_lock_retain_until_date

+  source_hash = var.source_hash
+
   tags = var.tags

   lifecycle {
---
modules/object/variables.tf
@@ -141,3 +141,9 @@ variable "object_lock_retain_until_date" {
   type        = string
   default     = null
 }
+
+variable "source_hash" {
+  description = "Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5(\"path/to/source\") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)"
+  type        = string
+  default     = null
+}
---
wrappers/object/main.tf
@@ -27,4 +27,5 @@ module "wrapper" {
   object_lock_legal_hold_status = try(each.value.object_lock_legal_hold_status, var.defaults.object_lock_legal_hold_status, null)
   object_lock_mode              = try(each.value.object_lock_mode, var.defaults.object_lock_mode, null)
   object_lock_retain_until_date = try(each.value.object_lock_retain_until_date, var.defaults.object_lock_retain_until_date, null)
+  source_hash                   = try(each.value.source_hash, var.defaults.source_hash, null)
 }
---

---

Choice B:
modules/object/README.md
@@ -51,6 +51,7 @@ No modules.
 |  [object\_lock\_mode](#input\_object\_lock\_mode) | The object lock retention mode that you want to apply to this object. Valid values are GOVERNANCE and COMPLIANCE. | `string` | `null` | no |
 |  [object\_lock\_retain\_until\_date](#input\_object\_lock\_retain\_until\_date) | The date and time, in RFC3339 format, when this object's object lock will expire. | `string` | `null` | no |
 |  [server\_side\_encryption](#input\_server\_side\_encryption) | Specifies server-side encryption of the object in S3. Valid values are "AES256" and "aws:kms". | `string` | `null` | no |
+|  [source\_hash](#input\_source\_hash) | Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5("path/to/source") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.) | `string` | `null` | no |
 |  [storage\_class](#input\_storage\_class) | Specifies the desired Storage Class for the object. Can be either STANDARD, REDUCED\_REDUNDANCY, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, DEEP\_ARCHIVE, or STANDARD\_IA. Defaults to STANDARD. | `string` | `null` | no |
 |  [tags](#input\_tags) | A map of tags to assign to the object. | `map(string)` | `{}` | no |
 |  [website\_redirect](#input\_website\_redirect) | Specifies a target URL for website redirect. | `string` | `null` | no |
---
modules/object/main.tf
@@ -29,6 +29,8 @@ resource "aws_s3_object" "this" {
   object_lock_mode              = try(upper(var.object_lock_mode), var.object_lock_mode)
   object_lock_retain_until_date = var.object_lock_retain_until_date

+  source_hash = var.source_hash
+
   tags = var.tags

   lifecycle {
---
modules/object/variables.tf
@@ -141,3 +141,9 @@ variable "object_lock_retain_until_date" {
   type        = string
   default     = null
 }
+
+variable "source_hash" {
+  description = "Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5(\"path/to/source\") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)"
+  type        = string
+  default     = null
+}
---
wrappers/object/main.tf
@@ -27,4 +27,5 @@ module "wrapper" {
   object_lock_legal_hold_status = try(each.value.object_lock_legal_hold_status, var.defaults.object_lock_legal_hold_status, null)
   object_lock_mode              = try(each.value.object_lock_mode, var.defaults.object_lock_mode, null)
   object_lock_retain_until_date = try(each.value.object_lock_retain_until_date, var.defaults.object_lock_retain_until_date, null)
+  source_hash                   = try(each.value.source_hash, var.defaults.source_hash, null)
 }
---

---

Choice C:
modules/object/README.md
@@ -51,6 +51,7 @@ No modules.
 |  [object\_lock\_mode](#input\_object\_lock\_mode) | The object lock retention mode that you want to apply to this object. Valid values are GOVERNANCE and COMPLIANCE. | `string` | `null` | no |
 |  [object\_lock\_retain\_until\_date](#input\_object\_lock\_retain\_until\_date) | The date and time, in RFC3339 format, when this object's object lock will expire. | `string` | `null` | no |
 |  [server\_side\_encryption](#input\_server\_side\_encryption) | Specifies server-side encryption of the object in S3. Valid values are "AES256" and "aws:kms". | `string` | `null` | no |
+|  [source\_hash](#input\_source\_hash) | Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5("path/to/source") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.) | `string` | `null` | no |
 |  [storage\_class](#input\_storage\_class) | Specifies the desired Storage Class for the object. Can be either STANDARD, REDUCED\_REDUNDANCY, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, DEEP\_ARCHIVE, or STANDARD\_IA. Defaults to STANDARD. | `string` | `null` | no |
 |  [tags](#input\_tags) | A map of tags to assign to the object. | `map(string)` | `{}` | no |
 |  [website\_redirect](#input\_website\_redirect) | Specifies a target URL for website redirect. | `string` | `null` | no |
---
modules/object/main.tf
@@ -29,6 +29,8 @@ resource "aws_s3_object" "this" {
   object_lock_mode              = try(upper(var.object_lock_mode), var.object_lock_mode)
   object_lock_retain_until_date = var.object_lock_retain_until_date

+  source_hash = var.source_hash
+
   tags = var.tags

   lifecycle {
---
modules/object/variables.tf
@@ -141,3 +141,9 @@ variable "object_lock_retain_until_date" {
   type        = string
   default     = null
 }
+
+variable "source_hash" {
+  description = "Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5(\"path/to/source\") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)"
+  type        = string
+  default     = null
+}
---
wrappers/object/main.tf
@@ -27,4 +27,5 @@ module "wrapper" {
   object_lock_legal_hold_status = try(each.value.object_lock_legal_hold_status, var.defaults.object_lock_legal_hold_status, null)
   object_lock_mode              = try(each.value.object_lock_mode, var.defaults.object_lock_mode, null)
   object_lock_retain_until_date = try(each.value.object_lock_retain_until_date, var.defaults.object_lock_retain_until_date, null)
+  source_hash                   = try(each.value.source_hash, var.defaults.source_hash, null)
 }
---

---

Choice D:
modules/object/README.md
@@ -51,6 +51,7 @@ No modules.
 |  [object\_lock\_mode](#input\_object\_lock\_mode) | The object lock retention mode that you want to apply to this object. Valid values are GOVERNANCE and COMPLIANCE. | `string` | `null` | no |
 |  [object\_lock\_retain\_until\_date](#input\_object\_lock\_retain\_until\_date) | The date and time, in RFC3339 format, when this object's object lock will expire. | `string` | `null` | no |
 |  [server\_side\_encryption](#input\_server\_side\_encryption) | Specifies server-side encryption of the object in S3. Valid values are "AES256" and "aws:kms". | `string` | `null` | no |
+|  [source\_hash](#input\_source\_hash) | Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5("path/to/source") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.) | `string` | `null` | no |
 |  [storage\_class](#input\_storage\_class) | Specifies the desired Storage Class for the object. Can be either STANDARD, REDUCED\_REDUNDANCY, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, DEEP\_ARCHIVE, or STANDARD\_IA. Defaults to STANDARD. | `string` | `null` | no |
 |  [tags](#input\_tags) | A map of tags to assign to the object. | `map(string)` | `{}` | no |
 |  [website\_redirect](#input\_website\_redirect) | Specifies a target URL for website redirect. | `string` | `null` | no |
---
modules/object/main.tf
@@ -29,6 +29,8 @@ resource "aws_s3_object" "this" {
   object_lock_mode              = try(upper(var.object_lock_mode), var.object_lock_mode)
   object_lock_retain_until_date = var.object_lock_retain_until_date

+  source_hash = var.source_hash
+
   tags = var.tags

   lifecycle {
---
modules/object/variables.tf
@@ -141,3 +141,9 @@ variable "object_lock_retain_until_date" {
   type        = string
   default     = null
 }
+
+variable "source_hash" {
+  description }
---
 "Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5(\"path/to/source\") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)"
+  type        = string
+  default     = null
+}
---
wrappers/object/main.tf
@@ -27,4 +27,5 @@ module "wrapper" {
   object_lock_legal_hold_status = try(each.value.object_lock_legal_hold_status, var.defaults.object_lock_legal_hold_status, null)
   object_lock_mode              = try(each.value.object_lock_mode, var.defaults.object_lock_mode, null)
   object_lock_retain_until_date = try(each.value.object_lock_retain_until_date, var.defaults.object_lock_retain_until_date, null)
+  source_hash                   = try(each.value.source_hash, var.defaults.source_hash, null)
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

Remove ignores_changes that are related to deprecated parameters.
Fixes #174

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

Some S3 bucket parameters got their own resources instead of being simple parameters.
Therefore, the ignore_changes is related to non-existent parameters.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

No breaking change.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---

Choice B:
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---

Choice C:
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---

Choice D:
main.tf
@@ -21,23 +21,6 @@ resource "aws_s3_bucket" "this" {
   force_destroy       = var.force_destroy
   object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
-
-  lifecycle {
-    ignore_changes = [
-      acceleration_status,
-      acl,
-      grant,
-      cors_rule,
-      lifecycle_rule,
-      logging,
-      object_lock_configuration,
-      replication_configuration,
-      request_payer,
-      server_side_encryption_configuration,
-      versioning,
-      website
-    ]
-  }
 }

 -21,23 "aws_s3_bucket_logging" "this" {
---

---