Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This change is about taking into account the recent enhancement of the AWS Terraform Provider which now allows to set S3 Replication Time Control (RTC)

## Motivation and Context
Thanks to this enhancement, we will be able to provision S3 Bucket Replication Configurations with SLAs and Metrics on the Replication itself from this terraform module.
It's the reflection on the module of the closure of the following issue : https://github.com/hashicorp/terraform-provider-aws/issues/10974

## Breaking Changes
There is no breaking change since I have just added the right attributes on the Replication configuration which are read from user input in the destination block of the replication_configuration attribute.

## How Has This Been Tested?
- [X ] I have tested and validated these changes using one or more of the provided `examples/*` projects

I have adapted the s3-replication example by adding the right input and I was able to successfully see metrics on the AWS S3 Bucket Console.

There was no need to add any control over user input since AWS API provides meaningful error messages in case user input is wrong :

│ Error: expected replication_configuration.0.rules.0.destination.0.replication_time.0.minutes to be in the range (15 - 15), got 16
│
│   with module.s3_bucket.aws_s3_bucket.this[0],
│   on ../../main.tf line 5, in resource "aws_s3_bucket" "this":
│    5: resource "aws_s3_bucket" "this" {
│

│ Error: expected replication_configuration.0.rules.0.destination.0.replication_time.0.status to be one of [Enabled Disabled], got yes
│
│   with module.s3_bucket.aws_s3_bucket.this[0],
│   on ../../main.tf line 5, in resource "aws_s3_bucket" "this":
│    5: resource "aws_s3_bucket" "this" {
│

│ Error: expected replication_configuration.0.rules.0.destination.0.metrics.0.minutes to be in the range (10 - 15), got 16
│
│   with module.s3_bucket.aws_s3_bucket.this[0],
│   on ../../main.tf line 5, in resource "aws_s3_bucket" "this":
│    5: resource "aws_s3_bucket" "this" {
│

│ Error: expected replication_configuration.0.rules.0.destination.0.metrics.0.status to be one of [Enabled Disabled], got true
│
│   with module.s3_bucket.aws_s3_bucket.this[0],
│   on ../../main.tf line 5, in resource "aws_s3_bucket" "this":
│    5: resource "aws_s3_bucket" "this" {
│

In this case the module users, will be easily able to correct their input to feed with the right values.

I have also ran pre-commit hooks as per the original pre-commit config file.

Thanks again for your review and feedback.

Bests.

---

Choice A:
.pre-commit-config.yaml
@@ -16,8 +16,8 @@ repos:
 #        entry: /Users/Bob/Sites/terraform-aws-modules/scripts/generate-terraform-wrappers.sh --module-dir modules/notification --overwrite
 #        language: system
 #        pass_filenames: false
-  - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.50.0
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.55.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -37,7 +37,7 @@ repos:
           - '--args=--only=terraform_required_providers'
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
-  - repo: git://github.com/pre-commit/pre-commit-hooks
-    rev: v3.4.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
     hooks:
       - id: check-merge-conflict
---
README.md
@@ -108,13 +108,13 @@ inputs = {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |

 ## Modules

---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.64 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/main.tf
@@ -83,6 +83,14 @@ module "s3_bucket" {
           access_control_translation = {
             owner = "Destination"
           }
+          replication_time = {
+            status  = "Enabled"
+            minutes = 15
+          }
+          metrics = {
+            status  = "Enabled"
+            minutes = 15
+          }
         }
       },
       {
@@ -128,4 +136,4 @@ module "s3_bucket" {
     ]
   }

-}
+}
\ No newline at end of file
---
examples/s3-replication/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.64"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -154,6 +154,24 @@ resource "aws_s3_bucket" "this" {
                   owner = access_control_translation.value.owner
                 }
               }
+
+              dynamic "replication_time" {
+                for_each = length(keys(lookup(destination.value, "replication_time", {}))) == 0 ? [] : [lookup(destination.value, "replication_time", {})]
+
+                content {
+                  status  = replication_time.value.status
+                  minutes = replication_time.value.minutes
+                }
+              }
+
+              dynamic "metrics" {
+                for_each = length(keys(lookup(destination.value, "metrics", {}))) == 0 ? [] : [lookup(destination.value, "metrics", {})]
+
+                content {
+                  status  = metrics.value.status
+                  minutes = metrics.value.minutes
+                }
+              }
             }
           }

---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws = ">= 3.50"
+    aws = ">= 3.64"
   }
 }
---
wrappers/README.md
@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/main.tf
@@ -30,4 +30,6 @@ module "wrapper" {
   block_public_policy                   = lookup(each.value, "block_public_policy", false)
   ignore_public_acls                    = lookup(each.value, "ignore_public_acls", false)
   restrict_public_buckets               = lookup(each.value, "restrict_public_buckets", false)
+  control_object_ownership              = lookup(each.value, "control_object_ownership", false)
+  object_ownership                      = lookup(each.value, "object_ownership", "ObjectWriter")
 }
---
wrappers/notification/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/object/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---

---

Choice B:
.pre-commit-config.yaml
@@ -16,8 +16,8 @@ repos:
 #        entry: /Users/Bob/Sites/terraform-aws-modules/scripts/generate-terraform-wrappers.sh --module-dir modules/notification --overwrite
 #        language: system
 #        pass_filenames: false
-  - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.50.0
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.55.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -37,7 +37,7 @@ repos:
           - '--args=--only=terraform_required_providers'
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
-  - repo: git://github.com/pre-commit/pre-commit-hooks
-    rev: v3.4.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
     hooks:
       - id: check-merge-conflict
---
README.md
@@ -108,13 +108,13 @@ inputs = {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |

 ## Modules

---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.64 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/main.tf
@@ -83,6 +83,14 @@ module "s3_bucket" {
           access_control_translation = {
             owner = "Destination"
           }
+          replication_time = {
+            status  = "Enabled"
+            minutes = 15
+          }
+          metrics = {
+            status  = "Enabled"
+            minutes = 15
+          }
         }
       },
       {
@@ -128,4 +136,4 @@ module "s3_bucket" {
     ]
   }

-}
+}
\ No newline at end of file
---
examples/s3-replication/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.64"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -154,6 +154,24 @@ resource "aws_s3_bucket" "this" {
                   owner = access_control_translation.value.owner
                 }
               }
+
+              dynamic "replication_time" {
+                for_each = length(keys(lookup(destination.value, "replication_time", {}))) == 0 ? [] : [lookup(destination.value, "replication_time", {})]
+
+                content {
+                  status  = replication_time.value.status
+                  minutes = replication_time.value.minutes
+                }
+              }
+
+              dynamic "metrics" {
+                for_each = length(keys(lookup(destination.value, "metrics", {}))) == 0 ? [] : [lookup(destination.value, "metrics", {})]
+
+                content {
+                  status  = metrics.value.status
+                  minutes = metrics.value.minutes
+                }
+              }
             }
           }

---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws = ">= 3.50"
+    aws = ">= 3.64"
   }
 }
---
wrappers/README.md
@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/main.tf
@@ -30,4 +30,6 @@ module "wrapper" {
   block_public_policy                   = lookup(each.value, "block_public_policy", false)
   ignore_public_acls                    = lookup(each.value, "ignore_public_acls", false)
   restrict_public_buckets               = lookup(each.value, "restrict_public_buckets", false)
+  control_object_ownership              = lookup(each.value, "control_object_ownership", false)
+  object_ownership                      = lookup(each.value, "object_ownership", "ObjectWriter")
 }
---
wrappers/notification/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/object/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---

---

Choice C:
.pre-commit-config.yaml
@@ -16,8 +16,8 @@ repos:
 #        entry: /Users/Bob/Sites/terraform-aws-modules/scripts/generate-terraform-wrappers.sh --module-dir modules/notification --overwrite
 #        language: system
 #        pass_filenames: false
-  - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.50.0
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.55.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -37,7 +37,7 @@ repos:
           - '--args=--only=terraform_required_providers'
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
-  - repo: git://github.com/pre-commit/pre-commit-hooks
-    rev: v3.4.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
     hooks:
       - id: check-merge-conflict
---
README.md
@@ -108,13 +108,13 @@ inputs = {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |

 ## Modules

---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.64 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/main.tf
@@ -83,6 +83,14 @@ module "s3_bucket" {
           access_control_translation = {
             owner = "Destination"
           }
+          replication_time = {
+            status  = "Enabled"
+            minutes = 15
+          }
+          metrics = {
+            status  = "Enabled"
+            minutes = 15
+          }
         }
       },
       {
@@ -128,4 +136,4 @@ module "s3_bucket" {
     ]
   }

-}
+}
\ No newline at end of file
---
examples/s3-replication/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.64"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -154,6 +154,24 @@ resource "aws_s3_bucket" "this" {
                   owner = access_control_translation.value.owner
                 }
               }
+
+              dynamic "replication_time" {
+                for_each = length(keys(lookup(destination.value, "replication_time", {}))) == 0 ? [] : [lookup(destination.value, "replication_time", {})]
+
+                content {
+                  status  = replication_time.value.status
+                  minutes = replication_time.value.minutes
+                }
+              }
+
+              dynamic "metrics" {
+                for_each = length(keys(lookup(destination.value, "metrics", {}))) == 0 ? [] : [lookup(destination.value, "metrics", {})]
+
+                content {
+                  status  = metrics.value.status
+                  minutes = metrics.value.minutes
+                }
+              }
             }
           }

---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws = ">= 3.50"
+    aws = ">= 3.64"
   }
 }
---
wrappers/README.md
@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/main.tf
@@ -30,4 +30,6 @@ module "wrapper" {
   block_public_policy                   = lookup(each.value, "block_public_policy", false)
   ignore_public_acls                    = lookup(each.value, "ignore_public_acls", false)
   restrict_public_buckets               = lookup(each.value, "restrict_public_buckets", false)
+  control_object_ownership              = lookup(each.value, "control_object_ownership", false)
+  object_ownership                      = lookup(each.value, "object_ownership", "ObjectWriter")
 }
---
wrappers/notification/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/object/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---

---

Choice D:
.pre-commit-config.yaml
@@ -16,8 +16,8 @@ repos:
 #        entry: /Users/Bob/Sites/terraform-aws-modules/scripts/generate-terraform-wrappers.sh --module-dir modules/notification --overwrite
 #        language: system
 #        pass_filenames: false
-  - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.50.0
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.55.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -37,7 +37,7 @@ repos:
           - '--args=--only=terraform_required_providers'
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
-  - repo: git://github.com/pre-commit/pre-commit-hooks
-    rev: v3.4.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
     hooks:
       - id: check-merge-conflict
---
README.md
@@ -108,13 +108,13 @@ inputs = {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |

 ## Modules

---
examples/s3-replication/README.md
@@ -22,15 +22,15 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [aws](#requirement\_aws) | >= 3.64 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.64 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.64 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/main.tf
@@ -83,6 +83,14 @@ module "s3_bucket" {
           access_control_translation = {
             owner = "Destination"
           }
+   want       replication_time = {
+            status  = "Enabled"
+            minutes = 15
+          }
+          metrics = {
+            status  = "Enabled"
+            minutes = 15
+          }
         }
       },
       {
@@ -128,4 +136,4 @@ module "s3_bucket" {
     ]
   }

-}
+}
\ No newline at end of file
---
examples/s3-replication/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.64"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -154,6 +154,24 @@ resource "aws_s3_bucket" "this" {
                   owner = access_control_translation.value.owner
                 }
               }
+
+              dynamic "replication_time" {
+                for_each = length(keys(lookup(destination.value, "replication_time", {}))) == 0 ? [] : [lookup(destination.value, "replication_time", {})]
+
+                content {
+                  status  = replication_time.value.status
+                  minutes = replication_time.value.minutes
+                }
+              }
+
+              dynamic "metrics" {
+                for_each = length(keys(lookup(destination.value, "metrics", {}))) == 0 ? [] : [lookup(destination.value, "metrics", {})]
+
+                content {
+                  status  = metrics.value.status
+                  minutes = metrics.value.minutes
+                }
+              }
             }
           }

---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.13.1"

   required_providers {
-    aws = ">= 3.50"
+    aws = ">= 3.64"
   }
 }
---
wrappers/README.md
@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/main.tf
@@ -30,4 +30,6 @@ module "wrapper" {
   block_public_policy                   = lookup(each.value, "block_public_policy", false)
   ignore_public_acls                    = lookup(each.value, "ignore_public_acls", false)
   restrict_public_buckets               = lookup(each.value, "restrict_public_buckets", false)
+  control_object_ownership              = lookup(each.value, "control_object_ownership", false)
+  object_ownership                      = lookup(each.value, "object_ownership", "ObjectWriter")
 }
---
wrappers/notification/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---
wrappers/object/README.md
@@ -6,7 +6,7 @@ You may want to use a single Terragrunt configuration file to manage multiple re

 This wrapper does not implement any extra functionality.

-# Usage with Terragrunt
+## Usage with Terragrunt

 `terragrunt.hcl`:

@@ -28,7 +28,7 @@ inputs = {
 }
 ```

-## Usage with Terraform:
+## Usage with Terraform

 ```hcl
 module "wrapper" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Uses the new data resource for aws_cloudfront_log_delivery_canonical_user_id that provides this field instead of using the hardcoded value.

## Motivation and Context
Per this github issue: https://github.com/hashicorp/terraform-provider-aws/issues/12512 which has now been solved we can use this resource to provide this ID.

## Breaking Changes
 Will need to update provider to v3.6
 The most recent provider has this data block

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

I created this on my local by running terraform plan and apply and destroy to create the new bucket which was successfully created in AWS. To test cloudfront I have used this fork and have successfully received logs in s3.

---

Choice A:
README.md
@@ -107,7 +107,7 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers
---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
+|  [aws](#requirement\_aws) | >= 3.60 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.60 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
@@ -56,6 +56,7 @@ Note that this example may create resources which cost money. Run `terraform des
 | [aws_kms_key.objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
 | [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
 | [aws_canonical_user_id.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source |
+| [aws_cloudfront_log_delivery_canonical_user_id.cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudfront_log_delivery_canonical_user_id) | data source |
 | [aws_iam_policy_document.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs
---
examples/complete/main.tf
@@ -4,6 +4,8 @@ locals {

 data "aws_canonical_user_id" "current" {}

+data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}
+
 resource "random_pet" "this" {
   length = 2
 }
@@ -71,8 +73,7 @@ module "cloudfront_log_bucket" {
     }, {
     type        = "CanonicalUser"
     permissions = ["FULL_CONTROL"]
-    id          = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
-    # Ref. https://github.com/terraform-providers/terraform-provider-aws/issues/12512
+    id          = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront.id
     # Ref. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
   }]
   force_destroy = true
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.60"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |
---
examples/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/object/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/s3-replication/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/s3-replication/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
modules/notification/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.6 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.28 |

 ## Providers
---
modules/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.6"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.28"
---
modules/object/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket objects with different configurations.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.36 |

 ## Providers
---
modules/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.36"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.50"
---
wrappers/notification/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/object/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---

---

Choice B:
README.md
@@ -107,7 +107,7 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers
---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
+|  [aws](#requirement\_aws) | >= 3.60 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.60 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
@@ -56,6 +56,7 @@ Note that this example may create resources which cost money. Run `terraform des
 | [aws_kms_key.objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
 | [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
 | [aws_canonical_user_id.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source |
+| [aws_cloudfront_log_delivery_canonical_user_id.cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudfront_log_delivery_canonical_user_id) | data source |
 | [aws_iam_policy_document.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs
---
examples/complete/main.tf
@@ -4,6 +4,8 @@ locals {

 data "aws_canonical_user_id" "current" {}

+data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}
+
 resource "random_pet" "this" {
   length = 2
 }
@@ -71,8 +73,7 @@ module "cloudfront_log_bucket" {
     }, {
     type        = "CanonicalUser"
     permissions = ["FULL_CONTROL"]
-    id          = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
-    # Ref. https://github.com/terraform-providers/terraform-provider-aws/issues/12512
+    id          = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront.id
     # Ref. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
   }]
   force_destroy = true
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.60"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |
---
examples/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/object/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/s3-replication/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
   [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/s3-replication/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
modules/notification/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.6 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.28 |

 ## Providers
---
modules/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.6"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.28"
---
modules/object/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket objects with different configurations.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.36 |

 ## Providers
---
modules/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.36"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.50"
---
wrappers/notification/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/object/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---

---

Choice C:
README.md
@@ -107,7 +107,7 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers
---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
+|  [aws](#requirement\_aws) | >= 3.60 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.60 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
@@ -56,6 +56,7 @@ Note that this example may create resources which cost money. Run `terraform des
 | [aws_kms_key.objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
 | [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
 | [aws_canonical_user_id.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source |
+| [aws_cloudfront_log_delivery_canonical_user_id.cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudfront_log_delivery_canonical_user_id) | data source |
 | [aws_iam_policy_document.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs
---
examples/complete/main.tf
@@ -4,6 +4,8 @@ locals {

 data "aws_canonical_user_id" "current" {}

+data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}
+
 resource "random_pet" "this" {
   length = 2
 }
@@ -71,8 +73,7 @@ module "cloudfront_log_bucket" {
     }, {
     type        = "CanonicalUser"
     permissions = ["FULL_CONTROL"]
-    id          = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
-    # Ref. https://github.com/terraform-providers/terraform-provider-aws/issues/12512
+    id          = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront.id
     # Ref. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
   }]
   force_destroy = true
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.60"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |
---
examples/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
- of required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/object/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/s3-replication/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/s3-replication/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
modules/notification/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.6 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.28 |

 ## Providers
---
modules/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.6"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.28"
---
modules/object/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket objects with different configurations.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.36 |

 ## Providers
---
modules/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.36"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.50"
---
wrappers/notification/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/object/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---

---

Choice D:
README.md
@@ -107,7 +107,7 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers
---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.50 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
+|  [aws](#requirement\_aws) | >= 3.60 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws](#provider\_aws) | >= 3.60 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
@@ -56,6 +56,7 @@ Note that this example may create resources which cost money. Run `terraform des
 | [aws_kms_key.objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
 | [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
 | [aws_canonical_user_id.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source |
+| [aws_cloudfront_log_delivery_canonical_user_id.cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudfront_log_delivery_canonical_user_id) | data source |
 | [aws_iam_policy_document.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs
---
examples/complete/main.tf
@@ -4,6 +4,8 @@ locals {

 data "aws_canonical_user_id" "current" {}

+data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}
+
 resource "random_pet" "this" {
   length = 2
 }
@@ -71,8 +73,7 @@ module "cloudfront_log_bucket" {
     }, {
     type        = "CanonicalUser"
     permissions = ["FULL_CONTROL"]
-    id          = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
-    # Ref. https://github.com/terraform-providers/terraform-provider-aws/issues/12512
+    id          = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront.id
     # Ref. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
   }]
   force_destroy = true
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
-    aws    = ">= 3.50"
+    aws    = ">= 3.60"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |
---
examples/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/object/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
examples/s3-replication/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

---
examples/s3-replication/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws    = ">= 3.50"
---
modules/notification/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.6 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.28 |

 ## Providers
---
modules/notification/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.6"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.28"
---
modules/object/README.md
@@ -7,7 +7,7 @@ Creates S3 bucket objects with different configurations.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.13 |
+|  [terraform](#requirement\_terraform) | >= 0.13.1 |
 |  [aws](#requirement\_aws) | >= 3.36 |

 ## Providers
---
modules/object/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.36"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.31"
+  required_version = ">= 0.13.1"

   required_providers {
     aws = ">= 3.50"
---
wrappers/notification/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/object/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---
wrappers/versions.tf
@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 0.13.1"
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Based on #103

---

Choice A:
README.md
@@ -107,14 +107,14 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |

 ## Modules

---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,16 +19,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
     null   = ">= 2.0"
   }
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/s3-replication/README.md
@@ -21,16 +21,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -132,10 +132,11 @@ resource "aws_s3_bucket" "this" {
         for_each = replication_configuration.value.rules

         content {
-          id       = lookup(rules.value, "id", null)
-          priority = lookup(rules.value, "priority", null)
-          prefix   = lookup(rules.value, "prefix", null)
-          status   = rules.value.status
+          id                               = lookup(rules.value, "id", null)
+          priority                         = lookup(rules.value, "priority", null)
+          prefix                           = lookup(rules.value, "prefix", null)
+          delete_marker_replication_status = lookup(rules.value, "delete_marker_replication_status", null)
+          status                           = rules.value.status

           dynamic "destination" {
             for_each = length(keys(lookup(rules.value, "destination", {}))) == 0 ? [] : [lookup(rules.value, "destination", {})]
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws = ">= 3.36"
+    aws = ">= 3.50"
   }
 }
---

---

Choice B:
README.md
@@ -107,14 +107,14 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |

 ## Modules

---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,16 +19,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform |  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
     null   = ">= 2.0"
   }
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/s3-replication/README.md
@@ -21,16 +21,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -132,10 +132,11 @@ resource "aws_s3_bucket" "this" {
         for_each = replication_configuration.value.rules

         content {
-          id       = lookup(rules.value, "id", null)
-          priority = lookup(rules.value, "priority", null)
-          prefix   = lookup(rules.value, "prefix", null)
-          status   = rules.value.status
+          id                               = lookup(rules.value, "id", null)
+          priority                         = lookup(rules.value, "priority", null)
+          prefix                           = lookup(rules.value, "prefix", null)
+          delete_marker_replication_status = lookup(rules.value, "delete_marker_replication_status", null)
+          status                           = rules.value.status

           dynamic "destination" {
             for_each = length(keys(lookup(rules.value, "destination", {}))) == 0 ? [] : [lookup(rules.value, "destination", {})]
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws = ">= 3.36"
+    aws = ">= 3.50"
   }
 }
---

---

Choice C:
README.md
@@ -107,14 +107,14 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |

 ## Modules

---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,16 +19,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
     null   = ">= 2.0"
   }
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/s3-replication/README.md
@@ -21,16 +21,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -132,10 +132,11 @@ resource "aws_s3_bucket" "this" {
         for_each = replication_configuration.value.rules

         content {
-          id       = lookup(rules.value, "id", null)
-          priority = lookup(rules.value, "priority", null)
-          prefix   = lookup(rules.value, "prefix", null)
-          status   = rules.value.status
+          id                               = lookup(rules.value, "id", null)
+          priority                         = lookup(rules.value, "priority", null)
+          prefix                           = lookup(rules.value, "prefix", null)
+          delete_marker_replication_status = lookup(rules.value, "delete_marker_replication_status", null)
+          status                           = rules.value.status

           dynamic "destination" {
    length(keys(lookup(rules.value,         for_each = length(keys(lookup(rules.value, "destination", {}))) == 0 ? [] : [lookup(rules.value, "destination", {})]
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws = ">= 3.36"
+    aws = ">= 3.50"
   }
 }
---

---

Choice D:
README.md
@@ -107,14 +107,14 @@ inputs = {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |

 ## Modules

---
examples/complete/README.md
@@ -29,15 +29,15 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/complete/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/notification/README.md
@@ -19,16 +19,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [null](#requirement\_null) | >= 2.0 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [null](#provider\_null) | >= 2.0 |
 |  [random](#provider\_random) | >= 2.0 |

---
examples/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
     null   = ">= 2.0"
   }
---
examples/object/README.md
@@ -20,14 +20,14 @@ Note that this example may create resources which cost money. Run `terraform des
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/object/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 0.13"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
examples/s3-replication/README.md
@@ -21,16 +21,16 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
-|  [aws](#requirement\_aws) | >= 3.36 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
+|  [aws](#requirement\_aws) | >= 3.50 |
 |  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.36 |
-|  [aws.replica](#provider\_aws.replica) | >= 3.36 |
+|  [aws](#provider\_aws) | >= 3.50 |
+|  [aws.replica](#provider\_aws.replica) | >= 3.50 |
 |  [random](#provider\_random) | >= 2.0 |

 ## Modules
---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws    = ">= 3.36"
+    aws    = ">= 3.50"
     random = ">= 2.0"
   }
 }
---
main.tf
@@ -132,10 +132,11 @@ resource "aws_s3_bucket" "this" {
         for_each = replication_configuration.value.rules

         content {
-          id       = lookup(rules.value, "id", null)
-          priority = lookup(rules.value, "priority", null)
-          prefix   = lookup(rules.value, "prefix", null)
-          status   = rules.value.status
+          id                               = lookup(rules.value, "id", null)
+          priority                         = lookup(rules.value, "priority", null)
+          prefix                           = lookup(rules.value, "prefix", null)
+          delete_marker_replication_status = lookup(rules.value, "delete_marker_replication_status", null)
+          status                           = rules.value.status

           dynamic "destination" {
             for_each = length(keys(lookup(rules.value, "destination", {}))) == 0 ? [] : [lookup(rules.value, "destination", {})]
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
-    aws = ">= 3.36"
+    aws = ">= 3.50"
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Completely based on #104

Fixes #104

---

Choice A:
examples/s3-replication/main.tf
@@ -58,7 +58,7 @@ module "s3_bucket" {

     rules = [
       {
-        id       = "foo"
+        id       = "something-with-kms-and-filter"
         status   = "Enabled"
         priority = 10

@@ -86,25 +86,45 @@ module "s3_bucket" {
         }
       },
       {
-        id       = "bar"
+        id       = "something-with-filter"
         status   = "Enabled"
         priority = 20

+        filter = {
+          prefix = "two"
+          tags = {
+            ReplicateMe = "Yes"
+          }
+        }
+
         destination = {
           bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
           storage_class = "STANDARD"
         }
-
+      },
+      {
+        id       = "everything-with-filter"
+        status   = "Enabled"
+        priority = 30

         filter = {
-          prefix = "two"
-          tags = {
-            ReplicateMe = "Yes"
-          }
+          prefix = ""
         }

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
       },
+      {
+        id     = "everything-without-filters"
+        status = "Enabled"

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
+      },
     ]
   }

---
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---

Choice B:
examples/s3-replication/main.tf
@@ -58,7 +58,7 @@ module "s3_bucket" {

     rules = [
       {
-        id       = "foo"
+        id       = "something-with-kms-and-filter"
         status   = "Enabled"
         priority = 10

@@ -86,25 +86,45 @@ module "s3_bucket" {
         }

+     },
       {
-        id       = "bar"
+        id       = "something-with-filter"
         status   = "Enabled"
         priority = 20

+        filter = {
+          prefix = "two"
+          tags = {
+            ReplicateMe = "Yes"
+          }
+        }
+
         destination = {
           bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
           storage_class = "STANDARD"
         }
-
+      },
+      {
+        id       = "everything-with-filter"
+        status   = "Enabled"
+        priority = 30

         filter = {
-          prefix = "two"
-          tags = {
-            ReplicateMe = "Yes"
-          }
+          prefix = ""
         }

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
       },
+      {
+        id     = "everything-without-filters"
+        status = "Enabled"

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
+      },
     ]
   }

---
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---

Choice C:
examples/s3-replication/main.tf
@@ -58,7 +58,7 @@ module "s3_bucket" {

     rules = [
       {
-        id       = "foo"
+        id       = "something-with-kms-and-filter"
         status   = "Enabled"
         priority = 10

@@ -86,25 +86,45 @@ module "s3_bucket" {
         }
       },
       {
-        id       = "bar"
+        id       = "something-with-filter"
         status   = "Enabled"
         priority = 20

+        filter = {
+          prefix = "two"
+          tags = {
+            ReplicateMe = "Yes"
+          }
+        }
+
         destination = {
           bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
           storage_class = "STANDARD"
         }
-
+      },
+      {
+        id       = "everything-with-filter"
+        status   = "Enabled"
+        priority = 30

         filter = {
-          prefix = "two"
-          tags = {
-            ReplicateMe = "Yes"
-          }
+          prefix = ""
         }

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
       },
+      {
+        id     = "everything-without-filters"
+        status = "Enabled"

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
+      },
     ]
   }

---
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---

Choice D:
examples/s3-replication/main.tf
@@ -58,7 +58,7 @@ module "s3_bucket" {

     rules = [
       {
-        id       = "foo"
+        id       = "something-with-kms-and-filter"
         status   = "Enabled"
         priority = 10

@@ -86,25 +86,45 @@ module "s3_bucket" {
         }
       },
       {
-        id       = "bar"
+        id       = "something-with-filter"
         status   = "Enabled"
         priority = 20

+        filter = {
+          prefix = "two"
+          tags = {
+            ReplicateMe = "Yes"
+          }
+        }
+
         destination = {
           bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
           storage_class = "STANDARD"
         }
-
+      },
+      {
+        id       = "everything-with-filter"
+        status   = "Enabled"
+        priority = 30

         filter = {
-          prefix = "two"
-          tags = {
-            ReplicateMe = "Yes"
-          }
+          prefix = ""
         }

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
       },
+      {
+        id     = "everything-without-filters"
+        status = "Enabled"

+        destination = {
+          bucket        = "arn:aws:s3:::${local.destination_bucket_name}"
+          storage_class = "STANDARD"
+        }
+      },
     ]
   }

---
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Send an empty `filter` map if no (or empty) `filter` was specified in `replication_configuration`.

(I'm not a Terraform expert so I'm not sure if the way I've done it is the best 😅)

## Motivation and Context
In the absence of at least an empty `filter` map if no filter was specified in a rule, `terraform apply` gives the following error for multi-destination S3 replication rules. See [this](https://github.com/hashicorp/terraform-provider-aws/issues/16546) `terraform-provider-aws` issue for additional context.

`Number of distinct destination bucket ARNs cannot exceed 1`

## Breaking Changes
Does not break backwards compatibility with the current major version.

## How Has This Been Tested?
- [x]  I have tested and validated these changes using one or more of the provided `examples/*` projects.
- Tested using the `S3 bucket with Cross-Region Replication (CRR) enabled` example.
- Tweaked the example to replicate `s3_bucket` to two replica buckets in the same region (one replication rule without a filter specified).
- Observed the `Number of distinct destination bucket ARNs cannot exceed 1` error with unmodified code and successful application with modifications.

---

Choice A:
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---

Choice B:
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ?  : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---

Choice C:
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

             content {
               prefix = lookup(filter.value, "prefix", null)
---

---

Choice D:
main.tf
@@ -172,8 +172,16 @@ resource "aws_s3_bucket" "this" {
             }
           }

+          # Send empty map if `filter` is an empty map or absent entirely
           dynamic "filter" {
-            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [] : [lookup(rules.value, "filter", {})]
+            for_each = length(keys(lookup(rules.value, "filter", {}))) == 0 ? [{}] : []
+
+            content {}
+          }
+
+          # Send `filter` if it is present and has at least one field
+          dynamic "filter" {
+            for_each = length(keys(lookup(rules.value, "filter", {}))) != 0 ? [lookup(rules.value, "filter", {})] : []

       #      content {
               prefix = lookup(filter.value, "prefix", null)
---

---