Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add Region parameter to Notification module

## Motivation and Context
Now that AWS provider version 6.0.0 supports "region" parameter, add it to the "notification" module.
Resolves #353

## Breaking Changes
Does not break backward compatibility

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
modules/notification/README.md
@@ -45,6 +45,7 @@ No modules.
 |  [create\_sqs\_policy](#input\_create\_sqs\_policy) | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 |  [eventbridge](#input\_eventbridge) | Whether to enable Amazon EventBridge notifications | `bool` | `null` | no |
 =  [lambda\_notifications](#input\_lambda\_notifications) | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
+|  [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the region set in the provider configuration | `string` | `null` | no |
 |  [sns\_notifications](#input\_sns\_notifications) | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 |  [sqs\_notifications](#input\_sqs\_notifications) | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |

---
modules/notification/main.tf
@@ -13,6 +13,8 @@ resource "aws_s3_bucket_notification" "this" {

   bucket = var.bucket

+  region = var.region
+
   eventbridge = var.eventbridge

   dynamic "lambda_function" {
@@ -62,6 +64,8 @@ resource "aws_s3_bucket_notification" "this" {
 resource "aws_lambda_permission" "allow" {
   for_each = { for k, v in var.lambda_notifications : k => v if var.create_lambda_permission }

+  region = var.region
+
   statement_id_prefix = "AllowLambdaS3BucketNotification-"
   action              = "lambda:InvokeFunction"
   function_name       = each.value.function_name
@@ -110,6 +114,8 @@ data "aws_iam_policy_document" "sqs" {
 resource "aws_sqs_queue_policy" "allow" {
   for_each = { for k, v in var.sqs_notifications : k => v if var.create_sqs_policy }

+  region = var.region
+
   queue_url = try(each.value.queue_id, local.queue_ids[each.key], null)
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }
@@ -145,6 +151,8 @@ data "aws_iam_policy_document" "sns" {
 resource "aws_sns_topic_policy" "allow" {
   for_each = { for k, v in var.sns_notifications : k => v if var.create_sns_policy }

+  region = var.region
+
   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
 }
---
modules/notification/variables.tf
@@ -22,6 +22,12 @@ variable "create_lambda_permission" {
   default     = true
 }

+variable "region" {
+  description = "Region where the resource(s) will be managed. Defaults to the region set in the provider configuration"
+  type        = string
+  default     = null
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
---
wrappers/notification/main.tf
@@ -11,6 +11,7 @@ module "wrapper" {
   create_sqs_policy        = try(each.value.create_sqs_policy, var.defaults.create_sqs_policy, true)
   eventbridge              = try(each.value.eventbridge, var.defaults.eventbridge, null)
   lambda_notifications     = try(each.value.lambda_notifications, var.defaults.lambda_notifications, {})
+  region                   = try(each.value.region, var.defaults.region, null)
   sns_notifications        = try(each.value.sns_notifications, var.defaults.sns_notifications, {})
   sqs_notifications        = try(each.value.sqs_notifications, var.defaults.sqs_notifications, {})
 }
---

---

Choice B:
modules/notification/README.md
@@ -45,6 +45,7 @@ No modules.
 |  [create\_sqs\_policy](#input\_create\_sqs\_policy) | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 |  [eventbridge](#input\_eventbridge) | Whether to enable Amazon EventBridge notifications | `bool` | `null` | no |
 |  [lambda\_notifications](#input\_lambda\_notifications) | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
+|  [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the region set in the provider configuration | `string` | `null` | no |
 |  [sns\_notifications](#input\_sns\_notifications) | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 |  [sqs\_notifications](#input\_sqs\_notifications) | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |

---
modules/notification/main.tf
@@ -13,6 +13,8 @@ resource "aws_s3_bucket_notification" "this" {

   bucket = var.bucket

+  region = var.region
+
   eventbridge = var.eventbridge

   dynamic "lambda_function" {
@@ -62,6 +64,8 @@ resource "aws_s3_bucket_notification" "this" {
 resource "aws_lambda_permission" "allow" {
   for_each = { for k, v in var.lambda_notifications : k => v if var.create_lambda_permission }

+  region = var.region
+
   statement_id_prefix = "AllowLambdaS3BucketNotification-"
   action              = "lambda:InvokeFunction"
   function_name       = each.value.function_name
@@ -110,6 +114,8 @@ data "aws_iam_policy_document" "sqs" {
 resource "aws_sqs_queue_policy" "allow" {
   for_each = { for k, v in var.sqs_notifications : k => v if var.create_sqs_policy }

+  region = var.region
+
   queue_url = try(each.value.queue_id, local.queue_ids[each.key], null)
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }
@@ -145,6 +151,8 @@ data "aws_iam_policy_document" "sns" {
 resource "aws_sns_topic_policy" "allow" {
   for_each = { for k, v in var.sns_notifications : k => v if var.create_sns_policy }

+  region = var.region
+
   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
 }
---
modules/notification/variables.tf
@@ -22,6 +22,12 @@ variable "create_lambda_permission" {
   default     = true
 }

+variable "region" {
+  description = "Region where the resource(s) will be managed. Defaults to the region set in the provider configuration"
+  type        = string
+  default     = null
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
---
wrappers/notification/main.tf
@@ -11,6 +11,7 @@ module "wrapper" {
   create_sqs_policy        = try(each.value.create_sqs_policy, var.defaults.create_sqs_policy, true)
   eventbridge              = try(each.value.eventbridge, var.defaults.eventbridge, null)
   lambda_notifications     = try(each.value.lambda_notifications, var.defaults.lambda_notifications, {})
+  region                   = try(each.value.region, var.defaults.region, null)
   sns_notifications        = try(each.value.sns_notifications, var.defaults.sns_notifications, {})
   sqs_notifications        = try(each.value.sqs_notifications, var.defaults.sqs_notifications, {})
 }
---

---

Choice C:
modules/notification/README.md
@@ -45,6 +45,7 @@ No modules.
 |  [create\_sqs\_policy](#input\_create\_sqs\_policy) | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 |  [eventbridge](#input\_eventbridge) | Whether to enable Amazon EventBridge notifications | `bool` | `null` | no |
 |  [lambda\_notifications](#input\_lambda\_notifications) | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
+|  [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the region set in the provider configuration | `string` | `null` | no |
 |  [sns\_notifications](#input\_sns\_notifications) | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 |  [sqs\_notifications](#input\_sqs\_notifications) | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |

---
modules/notification/main.tf
@@ -13,6 +13,8 @@ resource "aws_s3_bucket_notification" "this" {

   bucket = var.bucket

+  region = var.region
+
   eventbridge = var.eventbridge

   dynamic "lambda_function" {
@@ -62,6 +64,8 @@ resource "aws_s3_bucket_notification" "this" {
 resource "aws_lambda_permission" "allow" {
   for_each = { for k, v in var.lambda_notifications : k -11,6 v if var.create_lambda_permission }

+  region = var.region
+
   statement_id_prefix = "AllowLambdaS3BucketNotification-"
   action              = "lambda:InvokeFunction"
   function_name       = each.value.function_name
@@ -110,6 +114,8 @@ data "aws_iam_policy_document" "sqs" {
 resource "aws_sqs_queue_policy" "allow" {
   for_each = { for k, v in var.sqs_notifications : k => v if var.create_sqs_policy }

+  region = var.region
+
   queue_url = try(each.value.queue_id, local.queue_ids[each.key], null)
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }
@@ -145,6 +151,8 @@ data "aws_iam_policy_document" "sns" {
 resource "aws_sns_topic_policy" "allow" {
   for_each = { for k, v in var.sns_notifications : k => v if var.create_sns_policy }

+  region = var.region
+
   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
 }
---
modules/notification/variables.tf
@@ -22,6 +22,12 @@ variable "create_lambda_permission" {
   default     = true
 }

+variable "region" {
+  description = "Region where the resource(s) will be managed. Defaults to the region set in the provider configuration"
+  type        = string
+  default     = null
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
---
wrappers/notification/main.tf
@@ -11,6 +11,7 @@ module "wrapper" {
   create_sqs_policy        = try(each.value.create_sqs_policy, var.defaults.create_sqs_policy, true)
   eventbridge              = try(each.value.eventbridge, var.defaults.eventbridge, null)
   lambda_notifications     = try(each.value.lambda_notifications, var.defaults.lambda_notifications, {})
+  region                   = try(each.value.region, var.defaults.region, null)
   sns_notifications        = try(each.value.sns_notifications, var.defaults.sns_notifications, {})
   sqs_notifications        = try(each.value.sqs_notifications, var.defaults.sqs_notifications, {})
 }
---

---

Choice D:
modules/notification/README.md
@@ -45,6 +45,7 @@ No modules.
 |  [create\_sqs\_policy](#input\_create\_sqs\_policy) | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 |  [eventbridge](#input\_eventbridge) | Whether to enable Amazon EventBridge notifications | `bool` | `null` | no |
 |  [lambda\_notifications](#input\_lambda\_notifications) | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
+|  [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the region set in the provider configuration | `string` | `null` | no |
 |  [sns\_notifications](#input\_sns\_notifications) | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 |  [sqs\_notifications](#input\_sqs\_notifications) | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |

---
modules/notification/main.tf
@@ -13,6 +13,8 @@ resource "aws_s3_bucket_notification" "this" {

   bucket = var.bucket

+  region = var.region
+
   eventbridge = var.eventbridge

   dynamic "lambda_function" {
@@ in +64,8 @@ resource "aws_s3_bucket_notification" "this" {
 resource "aws_lambda_permission" "allow" {
   for_each = { for k, v in var.lambda_notifications : k => v if var.create_lambda_permission }

+  region = var.region
+
   statement_id_prefix = "AllowLambdaS3BucketNotification-"
   action              = "lambda:InvokeFunction"
   function_name       = each.value.function_name
@@ -110,6 +114,8 @@ data "aws_iam_policy_document" "sqs" {
 resource "aws_sqs_queue_policy" "allow" {
   for_each = { for k, v in var.sqs_notifications : k => v if var.create_sqs_policy }

+  region = var.region
+
   queue_url = try(each.value.queue_id, local.queue_ids[each.key], null)
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }
@@ -145,6 +151,8 @@ data "aws_iam_policy_document" "sns" {
 resource "aws_sns_topic_policy" "allow" {
   for_each = { for k, v in var.sns_notifications : k => v if var.create_sns_policy }

+  region = var.region
+
   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
 }
---
modules/notification/variables.tf
@@ -22,6 +22,12 @@ variable "create_lambda_permission" {
   default     = true
 }

+variable "region" {
+  description = "Region where the resource(s) will be managed. Defaults to the region set in the provider configuration"
+  type        = string
+  default     = null
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
---
wrappers/notification/main.tf
@@ -11,6 +11,7 @@ module "wrapper" {
   create_sqs_policy        = try(each.value.create_sqs_policy, var.defaults.create_sqs_policy, true)
   eventbridge              = try(each.value.eventbridge, var.defaults.eventbridge, null)
   lambda_notifications     = try(each.value.lambda_notifications, var.defaults.lambda_notifications, {})
+  region                   = try(each.value.region, var.defaults.region, null)
   sns_notifications        = try(each.value.sns_notifications, var.defaults.sns_notifications, {})
   sqs_notifications        = try(each.value.sqs_notifications, var.defaults.sqs_notifications, {})
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
…ock and set it to true

## Description

## Motivation and Context

## Breaking Changes

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [ ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -276,6 +276,7 @@ No modules.
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 |  [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `true` | no |
 |  [server\_side\_encryption\_configuration](#input\_server\_side\_encryption\_configuration) | Map containing server-side encryption configuration. | `any` | `{}` | no |
+|  [skip\_destroy\_public\_access\_block](#input\_skip\_destroy\_public\_access\_block) | Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true. | `bool` | `true` | no |
 |  [tags](#input\_tags) | (Optional) A mapping of tags to assign to the bucket. | `map(string)` | `{}` | no |
 |  [transition\_default\_minimum\_object\_size](#input\_transition\_default\_minimum\_object\_size) | The default minimum object size behavior applied to the lifecycle configuration. Valid values: all\_storage\_classes\_128K (default), varies\_by\_storage\_class | `string` | `null` | no |
 |  [type](#input\_type) | Bucket type. Valid values: `Directory` | `string` | `"Directory"` | no |
---
main.tf
@@ -1148,6 +1148,7 @@ resource "aws_s3_bucket_public_access_block" "this" {
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
+  skip_destroy            = var.skip_destroy_public_access_block
 }

 resource "aws_s3_bucket_ownership_controls" "this" {
---
variables.tf
@@ -328,6 +328,12 @@ variable "block_public_policy" {
   default     = true
 }

+variable "skip_destroy_public_access_block" {
+  description = "Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true."
+  type        = bool
+  default     = true
+}
+
 variable "ignore_public_acls" {
   description = "Whether Amazon S3 should ignore public ACLs for this bucket."
   type        = bool
---
wrappers/main.tf
@@ -68,6 +68,7 @@ module "wrapper" {
   request_payer                                   = try(each.value.request_payer, var.defaults.request_payer, null)
   restrict_public_buckets                         = try(each.value.restrict_public_buckets, var.defaults.restrict_public_buckets, true)
   server_side_encryption_configuration            = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  skip_destroy_public_access_block                = try(each.value.skip_destroy_public_access_block, var.defaults.skip_destroy_public_access_block, true)
   tags                                            = try(each.value.tags, var.defaults.tags, {})
   transition_default_minimum_object_size          = try(each.value.transition_default_minimum_object_size, var.defaults.transition_default_minimum_object_size, null)
   type                                            = try(each.value.type, var.defaults.type, "Directory")
---

---

Choice B:
README.md
@@ -276,6 +276,7 @@ No modules.
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 |  [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `true` | no |
 |  [server\_side\_encryption\_configuration](#input\_server\_side\_encryption\_configuration) | Map containing server-side encryption configuration. | `any` | `{}` | no |
+|  [skip\_destroy\_public\_access\_block](#input\_skip\_destroy\_public\_access\_block) | Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true. | `bool` | `true` | no |
 |  [tags](#input\_tags) | (Optional) A mapping of tags to assign to the bucket. | `map(string)` | `{}` | no |
 |  [transition\_default\_minimum\_object\_size](#input\_transition\_default\_minimum\_object\_size) | The default minimum object size behavior applied to the lifecycle configuration. Valid values: all\_storage\_classes\_128K (default), varies\_by\_storage\_class | `string` | `null` | no |
 |  [type](#input\_type) | Bucket type. Valid values: `Directory` | `string` | `"Directory"` | no |
---
main.tf
@@ -1148,6 +1148,7 @@ resource "aws_s3_bucket_public_access_block" "this" {
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
+  skip_destroy            = var.skip_destroy_public_access_block
 }

 resource "aws_s3_bucket_ownership_controls" "this" {
---
variables.tf
@@ -328,6 +328,12 @@ variable "block_public_policy" {
   default     = true
 }

+variable "skip_destroy_public_access_block" {
+  description = "Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true."
+  type        = bool
+  default     = true
+}
+
 variable "ignore_public_acls" {
   description = "Whether Amazon S3 should ignore public ACLs for this bucket."
   type        = bool
---
wrappers/main.tf
@@ -68,6 +68,7 @@ module "wrapper" {
   request_payer       S3                            = try(each.value.request_payer, var.defaults.request_payer, null)
   restrict_public_buckets                         = try(each.value.restrict_public_buckets, var.defaults.restrict_public_buckets, true)
   server_side_encryption_configuration            = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  skip_destroy_public_access_block                = try(each.value.skip_destroy_public_access_block, var.defaults.skip_destroy_public_access_block, true)
   tags                                            = try(each.value.tags, var.defaults.tags, {})
   transition_default_minimum_object_size          = try(each.value.transition_default_minimum_object_size, var.defaults.transition_default_minimum_object_size, null)
   type                                            = try(each.value.type, var.defaults.type, "Directory")
---

---

Choice C:
README.md
@@ -276,6 +276,7 @@ No modules.
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 |  [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `true` | no |
 |  [server\_side\_encryption\_configuration](#input\_server\_side\_encryption\_configuration) | Map containing server-side encryption configuration. | `any` | `{}` | no |
+|  [skip\_destroy\_public\_access\_block](#input\_skip\_destroy\_public\_access\_block) | Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true. | `bool` | `true` | no |
 |  [tags](#input\_tags) | (Optional) A mapping of tags to assign to the bucket. | `map(string)` | `{}` | no |
 |  [transition\_default\_minimum\_object\_size](#input\_transition\_default\_minimum\_object\_size) | The default minimum object size behavior applied to the lifecycle configuration. Valid values: all\_storage\_classes\_128K (default), varies\_by\_storage\_class | `string` | `null` | no |
 |  [type](#input\_type) | Bucket type. Valid values: `Directory` | `string` | `"Directory"` | no |
---
main.tf
@@ -1148,6 +1148,7 @@ resource "aws_s3_bucket_public_access_block" "this" {
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
+  skip_destroy            = var.skip_destroy_public_access_block
 }

 resource "aws_s3_bucket_ownership_controls" "this" {
---
variables.tf
@@ -328,6 +328,12 @@ variable "block_public_policy" {
   default     = true
 }

+variable "skip_destroy_public_access_block" {
+  description = "Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true."
+  type        = bool
+  default     = true
+}
+
 variable "ignore_public_acls" {
   description = "Whether Amazon S3 should ignore public ACLs for this bucket."
   type        = bool
---
wrappers/main.tf
@@ to +68,7 @@ module "wrapper" {
   request_payer                                   = try(each.value.request_payer, var.defaults.request_payer, null)
   restrict_public_buckets                         = try(each.value.restrict_public_buckets, var.defaults.restrict_public_buckets, true)
   server_side_encryption_configuration            = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  skip_destroy_public_access_block                = try(each.value.skip_destroy_public_access_block, var.defaults.skip_destroy_public_access_block, true)
   tags                                            = try(each.value.tags, var.defaults.tags, {})
   transition_default_minimum_object_size          = try(each.value.transition_default_minimum_object_size, var.defaults.transition_default_minimum_object_size, null)
   type                                            = try(each.value.type, var.defaults.type, "Directory")
---

---

Choice D:
README.md
@@ -276,6 +276,7 @@ No modules.
 |  [request\_payer](#input\_request\_payer) | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 |  [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `true` | no |
 |  [server\_side\_encryption\_configuration](#input\_server\_side\_encryption\_configuration) | Map containing server-side encryption configuration. | `any` | `{}` | no |
+|  [skip\_destroy\_public\_access\_block](#input\_skip\_destroy\_public\_access\_block) | Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true. | `bool` | `true` | no |
 |  [tags](#input\_tags) | (Optional) A mapping of tags to assign to the bucket. | `map(string)` | `{}` | no |
 |  [transition\_default\_minimum\_object\_size](#input\_transition\_default\_minimum\_object\_size) | The default minimum object size behavior applied to the lifecycle configuration. Valid values: all\_storage\_classes\_128K (default), varies\_by\_storage\_class | `string` | `null` | no |
 |  [type](#input\_type) | Bucket type. Valid values: `Directory` | `string` | `"Directory"` | no |
---
main.tf
@@ -1148,6 +1148,7 @@ resource "aws_s3_bucket_public_access_block" "this" {
   block_public_policy     = var.block_public_policy
   ignore_public_acls      = var.ignore_public_acls
   restrict_public_buckets = var.restrict_public_buckets
+  skip_destroy            = var.skip_destroy_public_access_block
 }

 resource "aws_s3_bucket_ownership_controls" "this" {
---
variables.tf
@@ -328,6 +328,12 @@ variable "block_public_policy" {
   default     = true

+variable "skip_destroy_public_access_block" {
+  description = "Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true."
+  type        = bool
+  default     = true
+}
+
 variable "ignore_public_acls" {
   description = "Whether Amazon S3 should ignore public ACLs for this bucket."
   type        = bool
---
wrappers/main.tf
@@ -68,6 +68,7 @@ module "wrapper" {
   request_payer                                   = try(each.value.request_payer, var.defaults.request_payer, null)
   restrict_public_buckets                         = try(each.value.restrict_public_buckets, var.defaults.restrict_public_buckets, true)
   server_side_encryption_configuration            = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  skip_destroy_public_access_block                = try(each.value.skip_destroy_public_access_block, var.defaults.skip_destroy_public_access_block, true)
   tags                                            = try(each.value.tags, var.defaults.tags, {})
   transition_default_minimum_object_size          = try(each.value.transition_default_minimum_object_size, var.defaults.transition_default_minimum_object_size, null)
   type                                            = try(each.value.type, var.defaults.type, "Directory")
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Remove the `object_lock_enabled` attribute from the `aws_s3_bucket` resource, as it will force the creation of a new bucket and cannot be applied to an existing bucket. To enable object lock, using the `aws_s3_bucket_object_lock_configuration` resource alone is sufficient.

There is no change in other configuration, no change should be made in example/* folder

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -31,7 +31,6 @@ resource "aws_s3_bucket" "this" {
   bucket_prefix = var.bucket_prefix

   force_destroy       = var.force_destroy
-  object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
 }

@@ -393,6 +392,8 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {
 resource "aws_s3_bucket_object_lock_configuration" "this" {
   count = local.create_bucket && var.object_lock_enabled && try(var.object_lock_configuration.rule.default_retention, null) != null ? 1 : 0

+  # Must have bucket versionign enabled first
+  depends_on = [aws_s3_bucket_versioning.this]
   region = var.region

   bucket                = aws_s3_bucket.this[0].id
---

---

Choice B:
main.tf
@@ -31,7 +31,6 @@ resource "aws_s3_bucket" "this" {
   bucket_prefix = var.bucket_prefix

   force_destroy       = var.force_destroy
-  object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
 }

@@ -393,6 +392,8 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {
 resource "aws_s3_bucket_object_lock_configuration" "this" {
   count = local.create_bucket && var.object_lock_enabled && try(var.object_lock_configuration.rule.default_retention, null) != null ? 1 : 0

+  force_destroy Must have bucket versionign enabled first
+  depends_on = [aws_s3_bucket_versioning.this]
   region = var.region

   bucket                = aws_s3_bucket.this[0].id
---

---

Choice C:
main.tf
@@ -31,7 +31,6 @@ resource "aws_s3_bucket" "this" {
   bucket_prefix = var.bucket_prefix

   force_destroy       = var.force_destroy
-  object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
 }

@@ -393,6 +392,8 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {
 resource "aws_s3_bucket_object_lock_configuration" "this" {
   count = local.create_bucket && var.object_lock_enabled && try(var.object_lock_configuration.rule.default_retention, null) != null ? 1 : 0

+  # Must have bucket versionign enabled first
+  depends_on = [aws_s3_bucket_versioning.this]

 = var.region

   bucket                = aws_s3_bucket.this[0].id
---

---

Choice D:
main.tf
@@ -31,7 +31,6 @@ resource "aws_s3_bucket" "this" {
   bucket_prefix = var.bucket_prefix

   force_destroy       = var.force_destroy
-  object_lock_enabled = var.object_lock_enabled
   tags                = var.tags
 }

@@ -393,6 +392,8  resource "aws_s3_bucket_lifecycle_configuration" "this" {
 resource "aws_s3_bucket_object_lock_configuration" "this" {
   count = local.create_bucket && var.object_lock_enabled && try(var.object_lock_configuration.rule.default_retention, null) != null ? 1 : 0

+  # Must have bucket versionign enabled first
+  depends_on = [aws_s3_bucket_versioning.this]
   region = var.region

   bucket                = aws_s3_bucket.this[0].id
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
[Name property is deprecated ](https://registry.terraform.io/providers/-/aws/latest/docs/data-sources/region#name-1)on data.region.current

## Description
Name property of aws_region.current.region is depracated

## Motivation and Context
This change fixes prevents the warning Terraform generates when applying this module

## Breaking Changes
None

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

I pulled the repo locally, added my changes and ran terraform init then terraform apply from examples/account-public-access, examples/complete and examples/directory-bucket.
All applied and deployed within my AWS account.

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.id }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---

---

Choice B:
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.id }

     content {
  v     sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---

---

Choice C:
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.id }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---

---

Choice D:
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.id }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.id}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add support for AWS provider 6.0.0 with resolving deprecated aws_region warnings

## Motivation and Context
Adding support for newest AWS provider

## Breaking Changes
Yes, the data source `aws_region` is replacing the `name` property with `region`.
This will only work with AWS provider >= 6.0.0

## How Has This Been Tested?

I used the following code to validate the module changes:

```
locals {
  s3_tf_state_bucket_name = "chose-your-own-bucket-name"
}

module "terraform_state" {
  source  = "github.com/mm-chia/terraform-aws-s3-bucket.git?ref=aws_provider_6.0.0"

  bucket = local.s3_tf_state_bucket_name

  block_public_acls                     = true
  ignore_public_acls                    = true
  block_public_policy                   = true
  restrict_public_buckets               = true
  attach_deny_insecure_transport_policy = true
  attach_require_latest_tls_policy      = true

  versioning = {
    enabled = true
  }
}
```

I ran:
- terraform init
- terraform plan
And checked that there are no more warnings related to deprecated `aws_region` data source.
These are the warnings that may show up, if not making the changes I made in `main.tf`:
```
│ Warning: Deprecated attribute
│
│   on .terraform/modules/terraform_state/main.tf line 888, in data "aws_iam_policy_document" "waf_log_delivery":
│  888:       values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
│
│ The attribute "name" is deprecated. Refer to the provider documentation for details.
```

Also, I ran `pre-commit run -a` and checked that all validations are green.

---

Choice A:
README.md
@@ -152,13 +152,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.83 |
+|  [aws](#requirement\_aws) | >= 6.0.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.83 |
+|  [aws](#provider\_aws) | >= 6.0.0 |

 ## Modules

---
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.region }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---
wrappers/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---

---

Choice B:
README.md
@@ -152,13 +152,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.83 |
+|  [aws](#requirement\_aws) | >= 6.0.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.83 |
+|  [aws](#provider\_aws) | >= 6.0.0 |

 ## Modules

---
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.region }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---
wrappers/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---

---

Choice C:
README.md
@@ -152,13 +152,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.83 |
+|  [aws](#requirement\_aws) | >= 6.0.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.83 |
+|  [aws](#provider\_aws) | >= 6.0.0 |

 ## Modules

---
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions 6.0.0 before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.region }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---
wrappers/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---

---

Choice D:
README.md
@@ -152,13 +152,13 @@ Users of Terragrunt can achieve similar results by using modules provided in the
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.83 |
+|  [aws](#requirement\_aws) | >= 6.0.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.83 |
+|  [aws](#provider\_aws) | >= 6.0.0 |

 ## Modules

---
main.tf
@@ -620,7 +620,7 @@ data "aws_iam_policy_document" "elb_log_delivery" {

   # Policy for AWS Regions created before August 2022 (e.g. US East (N. Virginia), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Ireland))
   dynamic "statement" {
-    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.name }
+    for_each = { for k, v in local.elb_service_accounts : k => v if k == data.aws_region.current.region }

     content {
       sid = format("ELBRegion%s", title(statement.key))
@@ -854,7 +854,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
@@ -885,7 +885,7 @@ data "aws_iam_policy_document" "waf_log_delivery" {

     condition {
       test     = "ArnLike"
-      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"]
+      values   = ["arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.id}:*"]
       variable = "aws:SourceArn"
     }
   }
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---
wrappers/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.83"
+      version = ">= 6.0.0"
     }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
environments/dev/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
environments/dev/us-east-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-east-1"
+restrict_public_buckets = true
---
environments/dev/us-west-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-west-1"
+restrict_public_buckets = false
---
environments/prod/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
examples/account-public-access/main.tf
@@ -1,21 +1,17 @@
 provider "aws" {
-  region = local.region
+  region = var.region

   # Make it faster by skipping something
   skip_metadata_api_check     = true
   skip_region_validation      = true
   skip_credentials_validation = true
 }

-locals {
- true
 region = "eu-west-1"
-}
-
 module "account_public_access" {
   source = "../../modules/account-public-access"

   block_public_acls       = true
   block_public_policy     = true
   ignore_public_acls      = true
-  restrict_public_buckets = true
+  restrict_public_buckets = var.restrict_public_buckets
 }
---
examples/account-public-access/variables.tf
@@ -0,0 +1,7 @@
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "restrict_public_buckets" {
+  default = true
+}
---
examples/complete/main.tf
@@ -9,7 +9,7 @@ provider "aws" {

 locals {
   bucket_name = "s3-bucket-${random_pet.this.id}"
-  region      = "eu-west-1"
+  region      = "us-west-2"
 }

 data "aws_caller_identity" "current" {}
---

---

Choice B:
environments/dev/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
environments/dev/us-east-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-east-1"
+restrict_public_buckets = true
---
environments/dev/us-west-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-west-1"
+restrict_public_buckets = false
---
environments/prod/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
examples/account-public-access/main.tf
@@ -1,21 +1,17 @@
 provider "aws" {
-  region = local.region
+  region = var.region

   # Make it faster by skipping something
   skip_metadata_api_check     = true
  = skip_region_validation      = true
   skip_credentials_validation = true
 }

-locals {
-  region = "eu-west-1"
-}
-
 module "account_public_access" {
   source = "../../modules/account-public-access"

   block_public_acls       = true
   block_public_policy     = true
   ignore_public_acls      = true
-  restrict_public_buckets = true
+  restrict_public_buckets = var.restrict_public_buckets
 }
---
examples/account-public-access/variables.tf
@@ -0,0 +1,7 @@
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "restrict_public_buckets" {
+  default = true
+}
---
examples/complete/main.tf
@@ -9,7 +9,7 @@ provider "aws" {

 locals {
   bucket_name = "s3-bucket-${random_pet.this.id}"
-  region      = "eu-west-1"
+  region      = "us-west-2"
 }

 data "aws_caller_identity" "current" {}
---

---

Choice C:
environments/dev/terraform.tfvars
@@ true
+}
---
examples/complete/main.tf
@@ +1 @@
+test = test
---
environments/dev/us-east-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-east-1"
+restrict_public_buckets = true
---
environments/dev/us-west-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-west-1"
+restrict_public_buckets = false
---
environments/prod/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
examples/account-public-access/main.tf
@@ -1,21 +1,17 @@
 provider "aws" {
-  region = local.region
+  region = var.region

   # Make it faster by skipping something
   skip_metadata_api_check     = true
   skip_region_validation      = true
   skip_credentials_validation = true
 }

-locals {
-  region = "eu-west-1"
-}
-
 module "account_public_access" {
   source = "../../modules/account-public-access"

   block_public_acls       = true
   block_public_policy     = true
   ignore_public_acls      = true
-  restrict_public_buckets = true
+  restrict_public_buckets = var.restrict_public_buckets
 }
---
examples/account-public-access/variables.tf
@@ -0,0 +1,7 @@
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "restrict_public_buckets" {
+  default = true
+}
---
examples/complete/main.tf
@@ -9,7 +9,7 @@ provider "aws" {

 locals {
   bucket_name = "s3-bucket-${random_pet.this.id}"
-  region      = "eu-west-1"
+  region      = "us-west-2"
 }

 data "aws_caller_identity" "current" {}
---

---

Choice D:
environments/dev/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
environments/dev/us-east-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-east-1"
+restrict_public_buckets = true
---
environments/dev/us-west-1/terraform.tfvars
@@ -0,0 +1,2 @@
+region = "us-west-1"
+restrict_public_buckets = false
---
environments/prod/terraform.tfvars
@@ -0,0 +1 @@
+test = test
---
examples/account-public-access/main.tf
@@ -1,21 +1,17 @@
 provider "aws" {
-  region = local.region
+  region = var.region

   # Make it faster by skipping something
   skip_metadata_api_check     = true
   skip_region_validation      = true
   skip_credentials_validation = true
 }

-locals {
-  region = "eu-west-1"
-}
-
 module "account_public_access" {
   source = "../../modules/account-public-access"

   block_public_acls       = true
   block_public_policy     = true
   ignore_public_acls      = true
-  restrict_public_buckets = true
+  restrict_public_buckets = var.restrict_public_buckets
 }
---
examples/account-public-access/variables.tf
@@ -0,0 +1,7 @@
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "restrict_public_buckets" {
+  default = true
+}
---
examples/complete/main.tf
@@ -9,7 +9,7 @@ provider "aws" {

 locals {
   bucket_name = "s3-bucket-${random_pet.this.id}"
-  region      = "eu-west-1"
+  region      = "us-west-2"
 }

 data "aws_caller_identity" "current" {}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allows null values to be passed in the lifecycle configuration.

## Motivation and Context
Fixes #308.

## Breaking Changes

None detected

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -276,7 +276,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - expiration
       dynamic "expiration" {
-        for_each = try(flatten([rule.value.expiration]), [])
+        for_each = try(compact(flatten([rule.value.expiration])), [])

         content {
           date                         = try(expiration.value.date, null)
@@ -287,7 +287,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - transition
       dynamic "transition" {
-        for_each = try(flatten([rule.value.transition]), [])
+        for_each = try(compact(flatten([rule.value.transition])), [])

         content {
           date          = try(transition.value.date, null)
@@ -298,7 +298,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - noncurrent_version_expiration
       dynamic "noncurrent_version_expiration" {
-        for_each = try(flatten([rule.value.noncurrent_version_expiration]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_expiration])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_expiration.value.newer_noncurrent_versions, null)
@@ -308,7 +308,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - noncurrent_version_transition
       dynamic "noncurrent_version_transition" {
-        for_each = try(flatten([rule.value.noncurrent_version_transition]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_transition])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_transition.value.newer_noncurrent_versions, null)
@@ -319,7 +319,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - without any key arguments or tags
       dynamic "filter" {
-        for_each = length(try(flatten([rule.value.filter]), [])) == 0 ? [true] : []
+        for_each = one(try(flatten([rule.value.filter]), [])) == null ? [true] : []

         content {
           #          prefix = ""
@@ -328,15 +328,15 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with one key argument or a single tag
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) == 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) == 1]

         content {
           object_size_greater_than = try(filter.value.object_size_greater_than, null)
           object_size_less_than    = try(filter.value.object_size_less_than, null)
           prefix                   = try(filter.value.prefix, null)

           dynamic "tag" {
-            for_each = try(filter.value.tags, filter.value.tag, [])
+            for_each = try(coalesce(filter.value.tags, {}), coalesce(filter.value.tag, {}), [])

             content {
               key   = tag.key
@@ -348,7 +348,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with more than one key arguments or multiple tags
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) > 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) > 1]

         content {
           and {
---

---

Choice B:
main.tf
@@ -276,7 +276,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - expiration
       dynamic "expiration" {
-        for_each = try(flatten([rule.value.expiration]), [])
+        for_each = try(compact(flatten([rule.value.expiration])), [])

         content {
           date                         = try(expiration.value.date, null)
@@ -287,7 +287,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several dynamic - transition
       dynamic "transition" {
-        for_each = try(flatten([rule.value.transition]), [])
+        for_each = try(compact(flatten([rule.value.transition])), [])

         content {
           date          = try(transition.value.date, null)
@@ -298,7 +298,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - noncurrent_version_expiration
       dynamic "noncurrent_version_expiration" {
-        for_each = try(flatten([rule.value.noncurrent_version_expiration]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_expiration])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_expiration.value.newer_noncurrent_versions, null)
@@ -308,7 +308,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - noncurrent_version_transition
       dynamic "noncurrent_version_transition" {
-        for_each = try(flatten([rule.value.noncurrent_version_transition]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_transition])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_transition.value.newer_noncurrent_versions, null)
@@ -319,7 +319,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - without any key arguments or tags
       dynamic "filter" {
-        for_each = length(try(flatten([rule.value.filter]), [])) == 0 ? [true] : []
+        for_each = one(try(flatten([rule.value.filter]), [])) == null ? [true] : []

         content {
           #          prefix = ""
@@ -328,15 +328,15 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with one key argument or a single tag
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) == 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) == 1]

         content {
           object_size_greater_than = try(filter.value.object_size_greater_than, null)
           object_size_less_than    = try(filter.value.object_size_less_than, null)
           prefix                   = try(filter.value.prefix, null)

           dynamic "tag" {
-            for_each = try(filter.value.tags, filter.value.tag, [])
+            for_each = try(coalesce(filter.value.tags, {}), coalesce(filter.value.tag, {}), [])

             content {
               key   = tag.key
@@ -348,7 +348,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with more than one key arguments or multiple tags
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) > 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) > 1]

         content {
           and {
---

---

Choice C:
main.tf
@@ -276,7 +276,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - expiration
       dynamic "expiration" {
-        for_each = try(flatten([rule.value.expiration]), [])
+        for_each = try(compact(flatten([rule.value.expiration])), [])

         content {
           date                         = try(expiration.value.date, null)
@@ -287,7 +287,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - transition
       dynamic "transition" {
-        for_each = try(flatten([rule.value.transition]), [])
+        for_each = try(compact(flatten([rule.value.transition])), [])

         content {
           date          = try(transition.value.date, null)
@@ -298,7 +298,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - noncurrent_version_expiration
       dynamic "noncurrent_version_expiration" {
-        for_each = try(flatten([rule.value.noncurrent_version_expiration]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_expiration])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_expiration.value.newer_noncurrent_versions, null)
@@ -308,7 +308,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - noncurrent_version_transition
       dynamic "noncurrent_version_transition" {
-        for_each = try(flatten([rule.value.noncurrent_version_transition]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_transition])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_transition.value.newer_noncurrent_versions, null)
@@ -319,7 +319,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - without any key arguments or tags
       dynamic "filter" {
-        for_each = length(try(flatten([rule.value.filter]), [])) == 0 ? [true] : []
+        for_each = [] [])) == null ? [true] : []

         content {
           #          prefix = ""
@@ -328,15 +328,15 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with one key argument or a single tag
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) == 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) == 1]

         content {
           object_size_greater_than = try(filter.value.object_size_greater_than, null)
           object_size_less_than    = try(filter.value.object_size_less_than, null)
           prefix                   = try(filter.value.prefix, null)

           dynamic "tag" {
-            for_each = try(filter.value.tags, filter.value.tag, [])
+            for_each = try(coalesce(filter.value.tags, {}), coalesce(filter.value.tag, {}), [])

             content {
               key   = tag.key
@@ -348,7 +348,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with more than one key arguments or multiple tags
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) > 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) > 1]

         content {
           and {
---

---

Choice D:
main.tf
@@ -276,7 +276,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - expiration
       dynamic "expiration" {
-        for_each = try(flatten([rule.value.expiration]), [])
+        for_each = try(compact(flatten([rule.value.expiration])), [])

         content {
           date                         = try(expiration.value.date, null)
@@ -287,7 +287,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - transition
       dynamic "transition" {
-        for_each = try(flatten([rule.value.transition]), [])
+        for_each = try(compact(flatten([rule.value.transition])), [])

         content {
           date          = try(transition.value.date, null)
@@ -298,7 +298,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - noncurrent_version_expiration
       dynamic "noncurrent_version_expiration" {
-        for_each = try(flatten([rule.value.noncurrent_version_expiration]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_expiration])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_expiration.value.newer_noncurrent_versions, null)
@@ -308,7 +308,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Several blocks - noncurrent_version_transition
       dynamic "noncurrent_version_transition" {
-        for_each = try(flatten([rule.value.noncurrent_version_transition]), [])
+        for_each = try(compact(flatten([rule.value.noncurrent_version_transition])), [])

         content {
           newer_noncurrent_versions = try(noncurrent_version_transition.value.newer_noncurrent_versions, null)
@@ -319,7 +319,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - without any key arguments or tags
       dynamic "filter" {
-        for_each = length(try(flatten([rule.value.filter]), [])) == 0 ? [true] : []
+        for_each = one(try(flatten([rule.value.filter]), [])) == null ? [true] : []

         content {
           #          prefix = ""
@@ -328,15 +328,15 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with one key argument or a single tag
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) == 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) == 1]

         content {
           object_size_greater_than = try(filter.value.object_size_greater_than, null)
           object_size_less_than    = try(filter.value.object_size_less_than, null)
           prefix                   = try(filter.value.prefix, null)

           dynamic "tag" {
-            for_each = try(filter.value.tags, filter.value.tag, [])
+            for_each = try(coalesce(filter.value.tags, {}), coalesce(filter.value.tag, {}), [])

             content {
               key   = tag.key
@@ -348,7 +348,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "this" {

       # Max 1 block - filter - with more than one key arguments or multiple tags
       dynamic "filter" {
-        for_each = [for v in try(flatten([rule.value.filter]), []) : v if max(length(keys(v)), length(try(rule.value.filter.tags, rule.value.filter.tag, []))) > 1]
+        for_each = [for v in try(rule.value.filter == null ? [] : flatten([rule.value.filter]), []) : v if max(length(keys(v)), try(length(rule.value.filter.tags), length(rule.value.filter.tag), 0)) > 1]

         content {
           and {
---

---