Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
- align ci-cd static checks to use individual minimum Terraform versions

## Motivation and Context
- ensure that the modules are all following a similar workflow and the static checks that performed

## Breaking Changes
- No

## How Has This Been Tested?
- ci-cd static checks

---

Choice A:
.github/workflows/pre-commit.yml
@@ -7,55 +7,95 @@ on:
       - master

 jobs:
-  getBaseVersion:
-    name: Get min/max versions
-    runs-on: ubuntu-latest
+# Min Terraform version(s)
+  getDirectories:
+      name: Get root directories
+      runs-on: ubuntu-latest
+      steps:
+          - name: Checkout
+            uses: actions/checkout@v2
+          - name: Install Python
+            uses: actions/setup-python@v2
+          - name: Build matrix
+            id: matrix
+            run: |
+              DIRS=$(python -c "import json; import glob; print(json.dumps([x.replace('/versions.tf', '') for x in glob.glob('./**/versions.tf', recursive=True)]))")
+              echo "::set-output name=directories::$DIRS"
+      outputs:
+          directories: ${{ steps.matrix.outputs.directories }}

+  preCommitMinVersions:
+    name: Min TF validate
+    needs: getDirectories
+    runs-on: ubuntu-latest
+    strategy:
+        matrix:
+            directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+      - name: Install Python
+        uses: actions/setup-python@v2
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+        with:
+          directory: ${{ matrix.directory }}
+      - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ steps.minMax.outputs.minVersion }}
+      - name: Install pre-commit dependencies
+        run: pip install pre-commit
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+     uses:   if: ${{ matrix.directory !=  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory ==  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)
+

+# Max Terraform version
+  getBaseVersion:
+    name: Module max TF version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.1
     outputs:
       minVersion: ${{ steps.minMax.outputs.minVersion }}
       maxVersion: ${{ steps.minMax.outputs.maxVersion }}

-  preCommit:
-    name: Pre-commit check
+  preCommitMaxVersion:
+    name: Max TF pre-commit
     runs-on: ubuntu-latest
     needs: getBaseVersion
     strategy:
       fail-fast: false
       matrix:
         version:
-          - ${{ needs.getBaseVersion.outputs.minVersion }}
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
-
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-
       - name: Install Python
         uses: actions/setup-python@v2
-
       - name: Install Terraform v${{ matrix.version }}
         uses: hashicorp/setup-terraform@v1
         with:
           terraform_version: ${{ matrix.version }}
-
       - name: Install pre-commit dependencies
         run: |
           pip install pre-commit
           curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
           curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
-
-      - name: Execute pre-commit
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
-        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
-
       - name: Execute pre-commit
         # Run all pre-commit checks on max version supported
         if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
---
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.46.0
+    rev: v1.47.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
---

---

Choice B:
.github/workflows/pre-commit.yml
@@ -7,55 +7,95 @@ on:
       - master

 jobs:
-  getBaseVersion:
-    name: Get min/max versions
-    runs-on: ubuntu-latest
+# Min Terraform version(s)
+  getDirectories:
+      name: Get root directories
+      runs-on: ubuntu-latest
+      steps:
+          - name: Checkout
+            uses: actions/checkout@v2
+          - name: Install Python
+            uses: actions/setup-python@v2
+          - name: Build matrix
+            id: matrix
+            run: |
+              DIRS=$(python -c "import json; import glob; print(json.dumps([x.replace('/versions.tf', '') for x in glob.glob('./**/versions.tf', recursive=True)]))")
+              echo "::set-output name=directories::$DIRS"
+      outputs:
+          directories: ${{ steps.matrix.outputs.directories }}

+  preCommitMinVersions:
+    name: Min TF validate
+    needs: getDirectories
+    runs-on: ubuntu-latest
+    strategy:
+        matrix:
+            directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+      - name: Install Python
+        uses: actions/setup-python@v2
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+        with:
+          directory: ${{ matrix.directory }}
+      - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ steps.minMax.outputs.minVersion }}
+      - name: Install pre-commit dependencies
+        run: pip install pre-commit
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory !=  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory ==  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)
+

+# Max Terraform version
+  getBaseVersion:
+    name: Module max TF version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.1
     outputs:
       minVersion: ${{ steps.minMax.outputs.minVersion }}
       maxVersion: ${{ steps.minMax.outputs.maxVersion }}

-  preCommit:
-    name: Pre-commit check
+  preCommitMaxVersion:
+    name: Max TF pre-commit
     runs-on: ubuntu-latest
     needs: getBaseVersion
     strategy:
       fail-fast: false
       matrix:
         version:
-          - ${{ needs.getBaseVersion.outputs.minVersion }}
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
-
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-
       - name: Install Python
         uses: actions/setup-python@v2
-
       - name: Install Terraform v${{ matrix.version }}
         uses: hashicorp/setup-terraform@v1
         with:
           terraform_version: ${{ matrix.version }}
-
       - name: Install pre-commit dependencies
         run: |
           pip install pre-commit
           curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
           curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
-
-      - name: Execute pre-commit
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
-        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
-
       - name: Execute pre-commit
         # Run all pre-commit checks on max version supported
         if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
---
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.46.0
+    rev: v1.47.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
---

---

Choice C:
.github/workflows/pre-commit.yml
@@ -7,55 +7,95 @@ on:
       - master

 jobs:
-  getBaseVersion:
-    name: Get min/max versions
-    runs-on: ubuntu-latest
+# Min Terraform version(s)
+  getDirectories:
+      name: Get root directories
+      runs-on: ubuntu-latest
+      steps:
+          - name: Checkout
+            uses: actions/checkout@v2
+          - name: Install Python
+            uses: actions/setup-python@v2
+          - name: Build matrix
+            id: matrix
+            run: |
+              DIRS=$(python -c "import json; import glob; print(json.dumps([x.replace('/versions.tf', '') for x in glob.glob('./**/versions.tf', recursive=True)]))")
+              echo "::set-output name=directories::$DIRS"
+      outputs:
+          directories: ${{ steps.matrix.outputs.directories }}

+  preCommitMinVersions:
+    name: Min TF validate
+    needs: getDirectories
+    runs-on: ubuntu-latest
+    strategy:
+        matrix:
+            directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+      - name: Install Python
+        uses: actions/setup-python@v2
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+        with:
+          directory: ${{ matrix.directory }}
+      - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ steps.minMax.outputs.minVersion }}
+      - name: Install pre-commit dependencies
+        run: pip install pre-commit
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory !=  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory ==  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)
+

+# Max Terraform version
+  getBaseVersion:
+    name: Module max TF version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.1
     outputs:
       minVersion: ${{ steps.minMax.outputs.minVersion }}
       maxVersion: ${{ steps.minMax.outputs.maxVersion }}

-  preCommit:
-    name: Pre-commit check
+  preCommitMaxVersion:
+    name: Max TF pre-commit
     runs-on: ubuntu-latest
     needs: getBaseVersion
     strategy:
       fail-fast: false
       matrix:
         version:
-          - ${{ needs.getBaseVersion.outputs.minVersion }}
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
-
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-
       - name: Install Python
         uses: actions/setup-python@v2
-
       - name: Install Terraform v${{ matrix.version }}
         uses: hashicorp/setup-terraform@v1
         with:
           terraform_version: ${{ matrix.version }}
-
       - name: Install pre-commit dependencies
         run: |
           pip install pre-commit
           curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
           curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
-
-      - name: Execute pre-commit
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
-        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
-
       - name: Execute pre-commit
         # Run all pre-commit checks on max version supported
         if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
---
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.46.0
+    rev: v1.47.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
---

---

Choice D:
&& -7,55 +7,95 @@ on:
       - master

 jobs:
-  getBaseVersion:
-    name: Get min/max versions
-    runs-on: ubuntu-latest
+# Min Terraform version(s)
+  getDirectories:
+      name: Get root directories
+      runs-on: ubuntu-latest
+      steps:
+          - name: Checkout
+            uses: actions/checkout@v2
+          - name: Install Python
+            uses: actions/setup-python@v2
+          - name: Build matrix
+            id: matrix
+            run: |
+              DIRS=$(python -c "import json; import glob; print(json.dumps([x.replace('/versions.tf', '') for x in glob.glob('./**/versions.tf', recursive=True)]))")
+              echo "::set-output name=directories::$DIRS"
+      outputs:
+          directories: ${{ steps.matrix.outputs.directories }}

+  preCommitMinVersions:
+    name: Min TF validate
+    needs: getDirectories
+    runs-on: ubuntu-latest
+    strategy:
+        matrix:
+            directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+      - name: Install Python
+        uses: actions/setup-python@v2
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+        with:
+          directory: ${{ matrix.directory }}
+      - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ steps.minMax.outputs.minVersion }}
+      - name: Install pre-commit dependencies
+        run: pip install pre-commit
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory !=  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.directory ==  '.' }}
+        run:
+          pre-commit run terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)
+

+# Max Terraform version
+  getBaseVersion:
+    name: Module max TF version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.1
     outputs:
       minVersion: ${{ steps.minMax.outputs.minVersion }}
       maxVersion: ${{ steps.minMax.outputs.maxVersion }}

-  preCommit:
-    name: Pre-commit check
+  preCommitMaxVersion:
+    name: Max TF pre-commit
     runs-on: ubuntu-latest
     needs: getBaseVersion
     strategy:
       fail-fast: false
       matrix:
         version:
-          - ${{ needs.getBaseVersion.outputs.minVersion }}
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
-
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-
       - name: Install Python
         uses: actions/setup-python@v2
-
       - name: Install Terraform v${{ matrix.version }}
         uses: hashicorp/setup-terraform@v1
         with:
           terraform_version: ${{ matrix.version }}
-
       - name: Install pre-commit dependencies
         run: |
           pip install pre-commit
           curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
           curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
-
-      - name: Execute pre-commit
-        # Run only validate pre-commit check on min version supported
-        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
-        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
-
       - name: Execute pre-commit
         # Run all pre-commit checks on max version supported
         if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
---
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.46.0
+    rev: v1.47.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
- add ci-cd workflow for pre-commit checks

## Motivation and Context
- provide static checks for pull requests

## Breaking Changes
- no

## How Has This Been Tested?
- copy of what is implemented in SQS module repository

---

Choice A:
.github/workflows/pre-commit.yml
@@ -0,0 +1,62 @@
+name: Pre-Commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  getBaseVersion:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  preCommit:
+    name: Pre-commit check
+    runs-on: ubuntu-latest
+    needs: getBaseVersion
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.getBaseVersion.outputs.minVersion }}
+          - ${{ needs.getBaseVersion.outputs.maxVersion }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Python
+        uses: actions/setup-python@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Install pre-commit dependencies
+        run: |
+          pip install pre-commit
+          curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
+          curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
+
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
+
+      - name: Execute pre-commit
+        # Run all pre-commit checks on max version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files
---

---

Choice B:
.github/workflows/pre-commit.yml
@@ -0,0 +1,62 @@
+name: Pre-Commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  getBaseVersion:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  preCommit:
+    name: Pre-commit check
+    runs-on: ubuntu-latest
+    needs: getBaseVersion
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.getBaseVersion.outputs.minVersion }}
+          - ${{ needs.getBaseVersion.outputs.maxVersion }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Python
+        uses: actions/setup-python@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+  pre-commit      uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Install pre-commit dependencies
+        run: |
+          pip install pre-commit
+          curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
+          curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
+
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
+
+      - name: Execute pre-commit
+        # Run all pre-commit checks on max version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files
---

---

Choice C:
.github/workflows/pre-commit.yml
@@ -0,0 +1,62 @@
+name: Pre-Commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  getBaseVersion:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  preCommit:
+    name: Pre-commit check
+    runs-on: ubuntu-latest
+    needs: getBaseVersion
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.getBaseVersion.outputs.minVersion }}
+          - ${{ needs.getBaseVersion.outputs.maxVersion }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Python
+        uses: actions/setup-python@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Install pre-commit dependencies
+        run: |
+          pip install pre-commit
+          curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
+          curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
+
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
+
+      - name: Execute pre-commit
+        # Run all pre-commit checks on max version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files
---

---

Choice D:
.github/workflows/pre-commit.yml
@@ -0,0 +1,62 @@
+name: Pre-Commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  getBaseVersion:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@v1.0.1
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  preCommit:
+    name: Pre-commit check
+    runs-on: ubuntu-latest
+    needs: getBaseVersion
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.getBaseVersion.outputs.minVersion }}
+          - ${{ needs.getBaseVersion.outputs.maxVersion }}
+
+    steps:
+      - name: Checkout
+   Python
+     uses: actions/checkout@v2
+
+      - name: Install Python
+        uses: actions/setup-python@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Install pre-commit dependencies
+        run: |
+          pip install pre-commit
+          curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64" | head -n1)" > terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
+          curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
+
+      - name: Execute pre-commit
+        # Run only validate pre-commit check on min version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.minVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files terraform_validate
+
+      - name: Execute pre-commit
+        # Run all pre-commit checks on max version supported
+        if: ${{ matrix.version ==  needs.getBaseVersion.outputs.maxVersion }}
+        run: pre-commit run --color=always --show-diff-on-failure --all-files
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Make the creation of SNS/SQS policies conditional based on two new variables, `create_sns_policy` and `create_sqs_policy`.

## Motivation and Context
We have a use case (as I'm sure others do) where we need to send S3 bucket notifications to an external account that we don't control, and so we can't create the related SNS/SQS policies in that account (and they aren't necessary).  The rest of the notification setup is valid when using the external resource ARNs, however.

## Breaking Changes
None; the variables default to `true` so behavior will be the same.

## How Has This Been Tested?
```sh
$ terraform -v
Terraform v0.12.29
+ provider.aws v3.10.0
+ provider.null v2.1.2
+ provider.random v2.3.0
```

Using the module as published failed to apply the notification due to the inability create the policy, so I added it manually and imported it.  This snippet...:
```
module "redacted-bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "v1.15.0"

  bucket        = "redacted-bucket"
  acl           = "private"
  force_destroy = false

  tags = {
    creator     = "terraform"
  }

  versioning = {
    enabled = false
  }

  # S3 bucket-level Public Access Block configuration
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

module "redacted-bucket-notifications" {
  source  = "terraform-aws-modules/s3-bucket/aws//modules/notification"

  bucket            = module.redacted-bucket.this_s3_bucket_id

  # Common error - Error putting S3 notification configuration: InvalidArgument: Configuration is ambiguously defined. Cannot have overlapping suffixes in two rules if the prefixes are overlapping for the same event type.

  sqs_notifications = {
    sqs1 = {
      queue_arn     = "redacted-queue-arn"
      events        = ["s3:ObjectCreated:Put"]
      filter_suffix = ".gz"
    }
  }
}
```

... results in this plan:
```
Terraform will perform the following actions:

  # module.redacted-bucket-notifications.aws_sqs_queue_policy.allow["sqs1"] will be created
  + resource "aws_sqs_queue_policy" "allow" {
      + id        = (known after apply)
      + policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sqs:SendMessage"
                      + Condition = {
                          + ArnEquals = {
                              + aws:SourceArn = "arn:aws:s3:::redacted-bucket"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "s3.amazonaws.com"
                        }
                      + Resource  = "redacted-queue-arn"
                      + Sid       = "AllowSQSS3BucketNotification"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + queue_url = "redacted-queue-url"
    }

Plan: 1 to add, 0 to change, 0 to destroy.
```

Changing the module to use this branch like so...:
```
module "redacted-bucket-notifications" {
  source  = "github.com/bmurphey/terraform-aws-s3-bucket//modules/notification?ref=optional-create-policy"

  bucket                   = module.redacted-bucket.this_s3_bucket_id
  create_sqs_policy = false

  # Common error - Error putting S3 notification configuration: InvalidArgument: Configuration is ambiguously defined. Cannot have overlapping suffixes in two rules if the prefixes are overlapping for the same event type.

  sqs_notifications = {
    sqs1 = {
      queue_arn     = "redacted-queue-arn"
      events        = ["s3:ObjectCreated:Put"]
      filter_suffix = ".gz"
    }
  }
}
```

... results in `No changes. Infrastructure is up-to-date.`.  It appears to me that the SNS policy is created in the same manner, so I added a variable to make that policy creation conditional as well, but that hasn't been tested.

---

Choice A:
README.md
@@ -84,14 +84,14 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

---
examples/notification/README.md
@@ -19,18 +19,18 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Inputs

---
examples/notification/main.tf
@@ -76,6 +76,26 @@ resource "aws_sqs_queue" "this" {
   name  = "${random_pet.this.id}-${count.index}"
 }

+# SQS policy created outside of the module
+data "aws_iam_policy_document" "sqs_external" {
+  statement {
+    effect  = "Allow"
+    actions = ["sqs:SendMessage"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["s3.amazonaws.com"]
+    }
+
+    resources  [aws_sqs_queue.this[0].arn]
+  }
+}
+
+resource "aws_sqs_queue_policy" "allow_external" {
+  queue_url = aws_sqs_queue.this[0].id
+  policy    = data.aws_iam_policy_document.sqs_external.json
+}
+
 module "all_notifications" {
   source = "../../modules/notification"

@@ -129,4 +149,6 @@ module "all_notifications" {
     }
   }

+  # Creation of policy is handled outside of the module
+  create_sqs_policy = false
 }
---
examples/notification/versions.tf
@@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
-    null   = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2"
+    null   = ">= 2"
   }
 }
---
examples/s3-replication/README.md
@@ -21,17 +21,17 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| aws.replica | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| aws.replica | >= 3.0 |
+| random | >= 2.0 |

 ## Inputs

---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
modules/notification/README.md
@@ -7,15 +7,15 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

@@ -24,6 +24,8 @@ Creates S3 bucket notification resource with all supported types of deliveries:
 | bucket | Name of S3 bucket to use | `string` | `""` | no |
 | bucket\_arn | ARN of S3 bucket to use in policies | `string` | `null` | no |
 | create | Whether to create this resource or not? | `bool` | `true` | no |
+| create\_sns\_policy | Whether to create a policy for SNS permissions or not? | `bool` | `true` | no |
+| create\_sqs\_policy | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 | lambda\_notifications | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
 | sns\_notifications | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 | sqs\_notifications | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |
---
modules/notification/main.tf
@@ -74,7 +74,7 @@ data "aws_arn" "queue" {
 }

 data "aws_iam_policy_document" "sqs" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   statement {
     sid = "AllowSQSS3BucketNotification"
@@ -101,15 +101,15 @@ data "aws_iam_policy_document" "sqs" {
 }

 resource "aws_sqs_queue_policy" "allow" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   queue_url = lookup(each.value, "queue_id", lookup(local.queue_ids, each.key, null))
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }

 # SNS Topic
 data "aws_iam_policy_document" "sns" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   statement {
     sid = "AllowSNSS3BucketNotification"
@@ -136,7 +136,7 @@ data "aws_iam_policy_document" "sns" {
 }

 resource "aws_sns_topic_policy" "allow" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
---
modules/notification/variables.tf
@@ -4,6 +4,18 @@ variable "create" {
   default     = true
 }

+variable "create_sns_policy" {
+  description = "Whether to create a policy for SNS permissions or not?"
+  type        = bool
+  default     = true
+}
+
+variable "create_sqs_policy" {
+  description = "Whether to create a policy for SQS permissions or not?"
+  type        = bool
+  default     = true
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
@@ -18,18 +30,18 @@ variable "bucket_arn" {

 variable "lambda_notifications" {
   description = "Map of S3 bucket notifications to Lambda function"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sqs_notifications" {
   description = "Map of S3 bucket notifications to SQS queue"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sns_notifications" {
   description = "Map of S3 bucket notifications to SNS topic"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }
---
modules/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws = ">= 3.0, < 4.0"
+    aws = ">= 3.0"
   }
 }
---

---

Choice B:
README.md
@@ -84,14 +84,14 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

---
examples/notification/README.md
@@ -19,18 +19,18 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Inputs

---
examples/notification/main.tf
@@ -76,6 +76,26 @@ resource "aws_sqs_queue" "this" {
   name  = "${random_pet.this.id}-${count.index}"
 }

+# SQS policy created outside of the module
+data "aws_iam_policy_document" "sqs_external" {
+  statement {
+    effect  = "Allow"
+    actions = ["sqs:SendMessage"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["s3.amazonaws.com"]
+    }
+
+    resources = [aws_sqs_queue.this[0].arn]
+  }
+}
+
+resource "aws_sqs_queue_policy" "allow_external" {
+  queue_url = aws_sqs_queue.this[0].id
+  policy    = data.aws_iam_policy_document.sqs_external.json
+}
+
 module "all_notifications" {
   source = "../../modules/notification"

@@ -129,4 +149,6 @@ module "all_notifications" {
     }
   }

+  # Creation of policy is handled outside of the module
+  create_sqs_policy = false
 }
---
examples/notification/versions.tf
@@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
-    null   = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2"
+    null   = ">= 2"
   }
 }
---
examples/s3-replication/README.md
@@ -21,17 +21,17 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| aws.replica | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| aws.replica | >= 3.0 |
+| random | >= 2.0 |

 ## Inputs

---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
modules/notification/README.md
@@ -7,15 +7,15 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

@@ -24,6 +24,8 @@ Creates S3 bucket notification resource with all supported types of deliveries:
 | bucket | Name of S3 bucket to use | `string` | `""` | no |
 | bucket\_arn | ARN of S3 bucket to use in policies | `string` | `null` | no |
 | create | Whether to create this resource or not? | `bool` | `true` | no |
+| create\_sns\_policy | Whether to create a policy for SNS permissions or not? | `bool` | `true` | no |
+| create\_sqs\_policy | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 | lambda\_notifications | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
 | sns\_notifications | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 | sqs\_notifications | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |
---
modules/notification/main.tf
@@ -74,7 +74,7 @@ data "aws_arn" "queue" {
 }

 data "aws_iam_policy_document" "sqs" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   statement {
     sid = "AllowSQSS3BucketNotification"
@@ -101,15 +101,15 @@ data "aws_iam_policy_document" "sqs" {
 }

 resource "aws_sqs_queue_policy" "allow" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   queue_url = lookup(each.value, "queue_id", lookup(local.queue_ids, each.key, null))
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }

 # SNS Topic
 data "aws_iam_policy_document" "sns" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   statement {
     sid = "AllowSNSS3BucketNotification"
@@ -136,7 +136,7 @@ data "aws_iam_policy_document" "sns" {
 }

 resource "aws_sns_topic_policy" "allow" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
---
modules/notification/variables.tf
@@ -4,6 +4,18 @@ variable "create" {
   default     = true
 }

+variable "create_sns_policy" {
+  description = "Whether to create a policy for SNS permissions or not?"
+  type        = bool
+  default     = true
+}
+
+variable "create_sqs_policy" {
+  description = "Whether to create a policy for SQS permissions or not?"
+  type        = bool
+  default     = true
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
@@ -18,18 +30,18 @@ variable "bucket_arn" {

 variable "lambda_notifications" {
   description = "Map of S3 bucket notifications to Lambda function"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sqs_notifications" {
   description = "Map of S3 bucket notifications to SQS queue"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sns_notifications" {
   description = "Map of S3 bucket notifications to SNS topic"
-  type        = any # map(map(any)) is better, map(map(any)) Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }
---
modules/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws = ">= 3.0, < 4.0"
+    aws = ">= 3.0"
   }
 }
---

---

Choice C:
README.md
@@ -84,14 +84,14 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

---
examples/notification/README.md
@@ -19,18 +19,18 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Inputs

---
examples/notification/main.tf
@@ -76,6 +76,26 @@ resource "aws_sqs_queue" "this" {
   name  = "${random_pet.this.id}-${count.index}"
 }

+# SQS policy created outside of the module
+data "aws_iam_policy_document" "sqs_external" {
+  statement {
+    effect  = "Allow"
+    actions = ["sqs:SendMessage"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["s3.amazonaws.com"]
+    }
+
+    resources = [aws_sqs_queue.this[0].arn]
+  }
+}
+
+resource "aws_sqs_queue_policy" "allow_external" {
+  queue_url = aws_sqs_queue.this[0].id
+  policy    = data.aws_iam_policy_document.sqs_external.json
+}
+
 module "all_notifications" {
   source = "../../modules/notification"

@@ -129,4 +149,6 @@ module "all_notifications" {
     }
   }

+  # Creation of policy is handled outside of the module
+  create_sqs_policy = false
 }
---
examples/notification/versions.tf
@@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
-    null   = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2"
+    null   = ">= 2"
   }
 }
---
examples/s3-replication/README.md
@@ -21,17 +21,17 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| aws.replica | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| aws.replica | >= 3.0 |
+| random | >= 2.0 |

 ## Inputs

---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
modules/notification/README.md
@@ -7,15 +7,15 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >=  |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

@@ -24,6 +24,8 @@ Creates S3 bucket notification resource with all supported types of deliveries:
 | bucket | Name of S3 bucket to use | `string` | `""` | no |
 | bucket\_arn | ARN of S3 bucket to use in policies | `string` | `null` | no |
 | create | Whether to create this resource or not? | `bool` | `true` | no |
+| create\_sns\_policy | Whether to create a policy for SNS permissions or not? | `bool` | `true` | no |
+| create\_sqs\_policy | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 | lambda\_notifications | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
 | sns\_notifications | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 | sqs\_notifications | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |
---
modules/notification/main.tf
@@ -74,7 +74,7 @@ data "aws_arn" "queue" {
 }

 data "aws_iam_policy_document" "sqs" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   statement {
     sid = "AllowSQSS3BucketNotification"
@@ -101,15 +101,15 @@ data "aws_iam_policy_document" "sqs" {
 }

 resource "aws_sqs_queue_policy" "allow" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   queue_url = lookup(each.value, "queue_id", lookup(local.queue_ids, each.key, null))
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }

 # SNS Topic
 data "aws_iam_policy_document" "sns" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   statement {
     sid = "AllowSNSS3BucketNotification"
@@ -136,7 +136,7 @@ data "aws_iam_policy_document" "sns" {
 }

 resource "aws_sns_topic_policy" "allow" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
---
modules/notification/variables.tf
@@ -4,6 +4,18 @@ variable "create" {
   default     = true
 }

+variable "create_sns_policy" {
+  description = "Whether to create a policy for SNS permissions or not?"
+  type        = bool
+  default     = true
+}
+
+variable "create_sqs_policy" {
+  description = "Whether to create a policy for SQS permissions or not?"
+  type        = bool
+  default     = true
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
@@ -18,18 +30,18 @@ variable "bucket_arn" {

 variable "lambda_notifications" {
   description = "Map of S3 bucket notifications to Lambda function"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sqs_notifications" {
   description = "Map of S3 bucket notifications to SQS queue"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sns_notifications" {
   description = "Map of S3 bucket notifications to SNS topic"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }
---
modules/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws = ">= 3.0, < 4.0"
+    aws = ">= 3.0"
   }
 }
---

---

Choice D:
README.md
@@ -84,14 +84,14 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

---
examples/notification/README.md
@@ -19,18 +19,18 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| null | ~> 2 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| null | >= 2 |
+| random | >= 2 |

 ## Inputs

---
examples/notification/main.tf
@@ -76,6 +76,26 @@ resource "aws_sqs_queue" "this" {
   name  = "${random_pet.this.id}-${count.index}"
 }

+# SQS policy created outside of the module
+data "aws_iam_policy_document" "sqs_external" {
+  statement {
+    effect  = "Allow"
+    actions = ["sqs:SendMessage"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["s3.amazonaws.com"]
+    }
+
+    resources = [aws_sqs_queue.this[0].arn]
+  }
+}
+
+resource "aws_sqs_queue_policy" "allow_external" {
+  queue_url = aws_sqs_queue.this[0].id
+  policy    = data.aws_iam_policy_document.sqs_external.json
+}
+
 module "all_notifications" {
   source = "../../modules/notification"

@@ -129,4 +149,6 @@ module "all_notifications" {
     }
   }

+  # Creation of policy is handled outside of the module
+  create_sqs_policy = false
 }
---
examples/notification/versions.tf
@@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
-    null   = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2"
+    null   = ">= 2"
   }
 }
---
examples/s3-replication/README.md
@@ -21,17 +21,17 @@ Note that this example may create resources which cost money. Run `terraform des

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
-| aws.replica | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| aws | >= 3.0 |
+| aws.replica | >= 3.0 |
+| random | >= 2.0 |

 ## Inputs

---
examples/s3-replication/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
modules/notification/README.md
@@ -7,15 +7,15 @@ Creates S3 bucket notification resource with all supported types of deliveries:

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.6, < 0.14 |
-| aws | >= 3.0, < 4.0 |
-| random | ~> 2 |
+| terraform | >= 0.12.6 |
+| aws | >= 3.0 |
+| random | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 3.0, < 4.0 |
+| aws | >= 3.0 |

 ## Inputs

@@ -24,6 +24,8 @@ Creates S3 bucket notification resource with all supported types of deliveries:
 | bucket | Name of S3 bucket to use | `string` | `""` | no |
 | bucket\_arn | ARN of S3 bucket to use in policies | `string` | `null` | no |
 | create | Whether to create this resource or not? | `bool` | `true` | no |
+| create\_sns\_policy | Whether to create a policy for SNS permissions or not? | `bool` | `true` | no |
+| create\_sqs\_policy | Whether to create a policy for SQS permissions or not? | `bool` | `true` | no |
 | lambda\_notifications | Map of S3 bucket notifications to Lambda function | `any` | `{}` | no |
 | sns\_notifications | Map of S3 bucket notifications to SNS topic | `any` | `{}` | no |
 | sqs\_notifications | Map of S3 bucket notifications to SQS queue | `any` | `{}` | no |
---
modules/notification/main.tf
@@ -74,7 +74,7 @@ data "aws_arn" "queue" {
 }

 data "aws_iam_policy_document" "sqs" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   statement {
     sid = "AllowSQSS3BucketNotification"
@@ -101,15 +101,15 @@ data "aws_iam_policy_document" "sqs" {
 }

 resource "aws_sqs_queue_policy" "allow" {
-  for_each = var.sqs_notifications
+  for_each = var.create_sqs_policy ? var.sqs_notifications : tomap({})

   queue_url = lookup(each.value, "queue_id", lookup(local.queue_ids, each.key, null))
   policy    = data.aws_iam_policy_document.sqs[each.key].json
 }

 # SNS Topic
 data "aws_iam_policy_document" "sns" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   statement {
     sid = "AllowSNSS3BucketNotification"
@@ -136,7 +136,7 @@ data "aws_iam_policy_document" "sns" {
 }

 resource "aws_sns_topic_policy" "allow" {
-  for_each = var.sns_notifications
+  for_each = var.create_sns_policy ? var.sns_notifications : tomap({})

   arn    = each.value.topic_arn
   policy = data.aws_iam_policy_document.sns[each.key].json
---
modules/notification/variables.tf
@@ -4,6 +4,18 @@ variable "create" {
   default     = true
 }

+variable "create_sns_policy" {
+  description = "Whether to create a policy for SNS permissions or not?"
+  type        = bool
+  default     = true
+}
+
+variable "create_sqs_policy" {
+  description = "Whether to create a policy for SQS permissions or not?"
+  type        = bool
+  default     = true
+}
+
 variable "bucket" {
   description = "Name of S3 bucket to use"
   type        = string
@@ -18,18 +30,18 @@ variable "bucket_arn" {

 variable "lambda_notifications" {
   description = "Map of S3 bucket notifications to Lambda function"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sqs_notifications" {
   description = "Map of S3 bucket notifications to SQS queue"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }

 variable "sns_notifications" {
   description = "Map of S3 bucket notifications to SNS topic"
-  type        = any # map(map(any)) is better, but Terraform 0.12.25 panics
+  type        = any
   default     = {}
 }
---
modules/notification/versions.tf
@@ -1,8 +1,8 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws    = ">= 3.0, < 4.0"
-    random = "~> 2"
+    aws    = ">= 3.0"
+    random = ">= 2.0"
   }
 }
---
versions.tf
@@ -1,7 +1,7 @@
 terraform {
-  required_version = ">= 0.12.6, < 0.14"
+  required_version = ">= 0.12.6"

   required_providers {
-    aws = ">= 3.0, < 4.0"
+    aws = ">= 3.0"
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Fix #48

---

Choice A:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning | the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
---
variables.tf
@@ -78,7 +78,7 @@ variable "website" {

 variable "cors_rule" {
   description = "List of maps containing rules for Cross-Origin Resource Sharing."
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---

Choice B:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
---
variables.tf
@@ -78,7 +78,7 @@ variable "website" {

 variable "cors_rule" {
   description = "List of maps containing rules for Cross-Origin Resource Sharing."
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---

Choice C:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | grant | Cross-Origin ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
---
variables.tf
@@ -78,7 +78,7 @@ variable "website" {

 variable "cors_rule" {
   description = "List of maps containing rules for Cross-Origin Resource Sharing."
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---

Choice D:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts variable bucket. | `string` | `null` | no |
-| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
---
variables.tf
@@ -78,7 +78,7 @@ variable "website" {

 variable "cors_rule" {
   description = "List of maps containing rules for Cross-Origin Resource Sharing."
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
fix #45

---

Choice A:
README.md
@@ -109,7 +109,7 @@ module "s3_bucket" {
 | cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
-| grant | An ACL policy grant. Conflicts with `acl` | `list(any)` | `[]` | no |
+| grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
 | lifecycle\_rule | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
---
variables.tf
@@ -96,7 +96,7 @@ variable "logging" {

 variable "grant" {
   description = "An ACL policy grant. Conflicts with `acl`"
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---

Choice B:
README.md
@@ -109,7 +109,7 @@ module "s3_bucket" {
 | cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket | be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
-| grant | An ACL policy grant. Conflicts with `acl` | `list(any)` | `[]` | no |
+| grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
 | lifecycle\_rule | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
---
variables.tf
@@ -96,7 +96,7 @@ variable "logging" {

 variable "grant" {
   description = "An ACL policy grant. Conflicts with `acl`"
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---

Choice C:
README.md
@@ -109,7 +109,7 @@ module "s3_bucket" {
 | cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` |  | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
-| grant | An ACL policy grant. Conflicts with `acl` | `list(any)` | `[]` | no |
+| grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
 | lifecycle\_rule | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
---
variables.tf
@@ -96,7 +96,7 @@ variable "logging" {

 variable "grant" {
   description = "An ACL policy grant. Conflicts with `acl`"
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---

Choice D:
README.md
@@ -109,7 +109,7 @@ module "s3_bucket" {
 | cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
-| grant | An ACL policy grant. Conflicts with `acl` | `list(any)` | `[]` | no |
+| grant | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
 | lifecycle\_rule | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 | logging | Map containing access bucket logging configuration. bucket `map(string)` | `{}` | no |
---
variables.tf
@@ -96,7 +96,7 @@ variable "logging" {

 variable "grant" {
   description = "An ACL policy grant. Conflicts with `acl`"
-  type        = list(any)
+  type        = any
   default     = []
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Modify CORS to support multiple rules instead of a single rule
## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
When importing an existing bucket the module was attempting to remove all but one of the rules.
## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
Yes
<!-- If so, please provide an explanation why it is necessary. -->
Object to Array. It is possible to be backwards compatible, however, since the syntax is as simple as adding brackets there is little reason to add additional code.

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
Applying on an existing resource
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | Map containing a rule of Cross-Origin Resource Sharing. | `any` | `{}` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/main.tf
@@ -92,13 +92,21 @@ module "s3_bucket" {
     target_prefix = "log/"
   }

-  cors_rule = {
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
-    allowed_headers = ["*"]
-    expose_headers  = for    max_age_seconds = 3000
-  }
+  cors_rule = [
+    {
+      allowed_methods = ["PUT", "POST"]
+      allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+      }, {
+      allowed_methods = ["PUT"]
+      allowed_origins = ["https://example.com"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+    }
+  ]

   lifecycle_rule = [
     {
---
main.tf
@@ -21,7 +21,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = length(keys(var.cors_rule)) == 0 ? [] : [var.cors_rule]
+    for_each = var.cors_rule

     content {
       allowed_methods = cors_rule.value.allowed_methods
---
variables.tf
@@ -77,9 +77,9 @@ variable "website" {
 }

 variable "cors_rule" {
-  description = "Map containing a rule of Cross-Origin Resource Sharing."
-  type        = any # should be `map`, but it produces an error "all map elements must have the same type"
-  default     = {}
+  description = "List of maps containing rules for Cross-Origin Resource Sharing."
+  type        = list(any)
+  default     = []
 }

 variable "versioning" {
---

---

Choice B:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | Map containing a rule of Cross-Origin Resource Sharing. | `any` | `{}` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/main.tf
@@ -92,13 +92,21 @@ module "s3_bucket" {
     target_prefix = "log/"
   }

-  cors_rule = {
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
-    allowed_headers = ["*"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
+  cors_rule = [
+    {
+      allowed_methods = ["PUT", "POST"]
+      allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+      }, {
+      allowed_methods = ["PUT"]
+      allowed_origins = ["https://example.com"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+    }
+  ]

   lifecycle_rule = [
     {
---
main.tf
@@ -21,7 +21,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = length(keys(var.cors_rule)) == 0 ? [] : [var.cors_rule]
+    for_each = var.cors_rule

     content {
       allowed_methods = cors_rule.value.allowed_methods
---
variables.tf
@@ -77,9 +77,9 @@ variable "website" {
 }

 variable "cors_rule" {
-  description = "Map containing a rule of Cross-Origin Resource Sharing."
-  type        = any # should be `map`, but it produces an error "all map elements must have the same type"
-  default     = {}
+  description = "List of maps containing rules for Cross-Origin Resource Sharing."
+  type        = list(any)
+  default     = []
 }

 variable "versioning" {
---

---

Choice C:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | Map containing a rule of Cross-Origin Resource Sharing. | `any` | `{}` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/main.tf
@@ -92,13 +92,21 @@ module "s3_bucket" {
     target_prefix = "log/"
   }

-  cors_rule = {
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
-    allowed_headers = ["*"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
+  cors_rule = [
+    {
+      allowed_methods = ["PUT", "POST"]
+      allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+      }, {
+      allowed_methods = ["PUT"]
+      allowed_origins = ["https://example.com"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+    }
+  ]

   lifecycle_rule = [
     {
---
main.tf
@@ -21,7 +21,7 @@ resource "aws_s3_bucket" "this" {
  Whether }

   dynamic "cors_rule" {
-    for_each = length(keys(var.cors_rule)) == 0 ? [] : [var.cors_rule]
+    for_each = var.cors_rule

     content {
       allowed_methods = cors_rule.value.allowed_methods
---
variables.tf
@@ -77,9 +77,9 @@ variable "website" {
 }

 variable "cors_rule" {
-  description = "Map containing a rule of Cross-Origin Resource Sharing."
-  type        = any # should be `map`, but it produces an error "all map elements must have the same type"
-  default     = {}
+  description = "List of maps containing rules for Cross-Origin Resource Sharing."
+  type        = list(any)
+  default     = []
 }

 variable "versioning" {
---

---

Choice D:
README.md
@@ -106,7 +106,7 @@ module "s3_bucket" {
 | block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 | bucket | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
 | bucket\_prefix | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
-| cors\_rule | Map containing a rule of Cross-Origin Resource Sharing. | `any` | `{}` | no |
+| cors\_rule | List of maps containing rules for Cross-Origin Resource Sharing. | `list(any)` | `[]` | no |
 | create\_bucket | Controls if S3 bucket should be created | `bool` | `true` | no |
 | force\_destroy | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. {}
+ `bool` | `false` | no |
 | ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
---
examples/complete/main.tf
@@ -92,13 +92,21 @@ module "s3_bucket" {
     target_prefix = "log/"
   }

-  cors_rule = {
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
-    allowed_headers = ["*"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
+  cors_rule = [
+    {
+      allowed_methods = ["PUT", "POST"]
+      allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+      }, {
+      allowed_methods = ["PUT"]
+      allowed_origins = ["https://example.com"]
+      allowed_headers = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+    }
+  ]

   lifecycle_rule = [
     {
---
main.tf
@@ -21,7 +21,7 @@ resource "aws_s3_bucket" "this" {
   }

   dynamic "cors_rule" {
-    for_each = length(keys(var.cors_rule)) == 0 ? [] : [var.cors_rule]
+    for_each = var.cors_rule

     content {
       allowed_methods = cors_rule.value.allowed_methods
---
variables.tf
@@ -77,9 +77,9 @@ variable "website" {
 }

 variable "cors_rule" {
-  description = "Map containing a rule of Cross-Origin Resource Sharing."
-  type        = any # should be `map`, but it produces an error "all map elements must have the same type"
-  default     = {}
+  description = "List of maps containing rules for Cross-Origin Resource Sharing."
+  type        = list(any)
+  default     = []
 }

 variable "versioning" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
The 3.0 aws provider does not allow a region parameter for the `aws_s3_bucket` resource.

---

Choice A:
README.md
@@ -85,13 +85,13 @@ module "s3_bucket" {
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.6, < 0.14 |
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Providers
 < | Name | Version |
 |------|---------|
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Inputs

@@ -114,7 +114,6 @@ module "s3_bucket" {
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 | object\_lock\_configuration | Map containing S3 object locking configuration. | `any` | `{}` | no |
 | policy | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
-| region | (Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee. | `string` | `null` | no |
 | replication\_configuration | Map containing cross-region replication configuration. | `any` | `{}` | no |
 | request\_payer | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 | restrict\_public\_buckets | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `false` | no |
---
examples/s3-replication/main.tf
@@ -36,7 +36,6 @@ module "replica_bucket" {
   }

   bucket = local.destination_bucket_name
-  region = local.replica_region
   acl    = "private"

   versioning = {
@@ -48,7 +47,6 @@ module "s3_bucket" {
   source = "../../"

   bucket = local.bucket_name
-  region = local.origin_region
   acl    = "private"

   versioning = {
---
main.tf
@@ -7,7 +7,6 @@ resource "aws_s3_bucket" "this" {
   tags                = var.tags
   force_destroy       = var.force_destroy
   acceleration_status = var.acceleration_status
-  region              = var.region
   request_payer       = var.request_payer

   dynamic "website" {
---
variables.tf
@@ -64,12 +64,6 @@ variable "acceleration_status" {
   default     = null
 }

-variable "region" {
-  description = "(Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee."
-  type        = string
-  default     = null
-}
-
 variable "request_payer" {
   description = "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information."
   type        = string
---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.12.6, < 0.14"

   required_providers {
-    aws = "~> 2.35"
+    aws = ">= 3.0, < 4.0"
   }
 }
---

---

Choice B:
README.md
@@ -85,13 +85,13 @@ module "s3_bucket" {
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.6, < 0.14 |
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Inputs

@@ -114,7 +114,6 @@ module "s3_bucket" {
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 | object\_lock\_configuration | Map containing S3 object locking configuration. | `any` | `{}` | no |
 | policy | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
-| region | (Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee. | `string` | `null` | no |
 | replication\_configuration | Map containing cross-region replication configuration. | `any` | `{}` | no |
 | request\_payer | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 | restrict\_public\_buckets | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `false` | no |
---
examples/s3-replication/main.tf
@@ -36,7 +36,6 @@ module "replica_bucket" {
   }

   bucket = local.destination_bucket_name
-  region = local.replica_region
   acl    = "private"

   versioning = {
@@ -48,7 +47,6 @@ module "s3_bucket" {
   source = "../../"

   bucket = local.bucket_name
-  region = local.origin_region
   acl    = "private"

   versioning = {
---
main.tf
@@ -7,7 +7,6 @@ resource "aws_s3_bucket" "this" {
   tags                = var.tags
   force_destroy       = var.force_destroy
   acceleration_status = var.acceleration_status
-  region              = var.region
   request_payer       = var.request_payer

   dynamic "website" {
---
variables.tf
@@ -64,12 +64,6 @@ variable "acceleration_status" {
   default     = null
 }

-variable "region"   description = "(Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee."
-  type        = string
-  default     = null
-}
-
 variable "request_payer" {
   description = "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information."
   type        = string
---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.12.6, < 0.14"

   required_providers {
-    aws = "~> 2.35"
+    aws = ">= 3.0, < 4.0"
   }
 }
---

---

Choice C:
README.md
@@ -85,13 +85,13 @@ module "s3_bucket" {
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.6, < 0.14 |
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Inputs

@@ -114,7 +114,6 @@ module "s3_bucket" {
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 | object\_lock\_configuration | Map containing S3 object locking configuration. | `any` | `{}` | no |
 | policy | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. | `string` | `null` | no |
-| region | (Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee. | `string` | `null` | no |
 | replication\_configuration | Map containing cross-region replication configuration. | `any` | `{}` | no |
 | request\_payer | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 | restrict\_public\_buckets | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `false` | no |
---
examples/s3-replication/main.tf
@@ -36,7 +36,6 @@ module "replica_bucket" {
   }

   bucket = local.destination_bucket_name
-  region = local.replica_region
   acl    = "private"

   versioning = {
@@ -48,7 +47,6 @@ module "s3_bucket" {
   source = "../../"

   bucket = local.bucket_name
-  region = local.origin_region
   acl    = "private"

   versioning = {
---
main.tf
@@ -7,7 +7,6 @@ resource "aws_s3_bucket" "this" {
   tags                = var.tags
   force_destroy       = var.force_destroy
   acceleration_status = var.acceleration_status
-  region              = var.region
   request_payer       = var.request_payer

   dynamic "website" {
---
variables.tf
@@ -64,12 +64,6 @@ variable "acceleration_status" {
   default     = null
 }

-variable "region" {
-  description = "(Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee."
-  type        = string
-  default     = null
-}
-
 variable "request_payer" {
   description = "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information."
   type        = string
---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.12.6, < 0.14"

   required_providers {
-    aws = "~> 2.35"
+    aws = ">= 3.0, < 4.0"
   }
 }
---

---

Choice D:
README.md
@@ -85,13 +85,13 @@ module "s3_bucket" {
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.6, < 0.14 |
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | ~> 2.35 |
+| aws | >= 3.0, < 4.0 |

 ## Inputs

@@ -114,7 +114,6 @@ module "s3_bucket" {
 | logging | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 | object\_lock\_configuration | Map containing S3 object locking configuration. | `any` | `{}` | no |
 | policy | (Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy  Guide. | `string` | `null` | no |
-| region | (Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee. | `string` | `null` | no |
 | replication\_configuration | Map containing cross-region replication configuration. | `any` | `{}` | no |
 | request\_payer | (Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information. | `string` | `null` | no |
 | restrict\_public\_buckets | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `false` | no |
---
examples/s3-replication/main.tf
@@ -36,7 +36,6 @@ module "replica_bucket" {
   }

   bucket = local.destination_bucket_name
-  region = local.replica_region
   acl    = "private"

   versioning = {
@@ -48,7 +47,6 @@ module "s3_bucket" {
   source = "../../"

   bucket = local.bucket_name
-  region = local.origin_region
   acl    = "private"

   versioning = {
---
main.tf
@@ -7,7 +7,6 @@ resource "aws_s3_bucket" "this" {
   tags                = var.tags
   force_destroy       = var.force_destroy
   acceleration_status = var.acceleration_status
-  region              = var.region
   request_payer       = var.request_payer

   dynamic "website" {
---
variables.tf
@@ -64,12 +64,6 @@ variable "acceleration_status" {
   default     = null
 }

-variable "region" {
-  description = "(Optional) If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee."
-  type        = string
-  default     = null
-}
-
 variable "request_payer" {
   description = "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information."
   type        = string
---
versions.tf
@@ -2,6 +2,6 @@ terraform {
   required_version = ">= 0.12.6, < 0.14"

   required_providers {
-    aws = "~> 2.35"
+    aws = ">= 3.0, < 4.0"
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Update the required version block to allow 0.13 usage

## Motivation and Context
This module cannot be used with the 0.13 versions of terraform (beta, or the upcoming GA), this modifies the version so that it can at least be used. However, there are other changes that might be desirable, such as deprecating the `create_bucket` argument now that module count will be available.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
Forked this repo, changed the file, and ran through loading the module, changing count, and changing for_each.
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
README.md
@@ -22,7 +22,7 @@ These features of S3 bucket configurations are supported:

 ## Terraform versions

-Only Terraform 0.12 is supported.
+Terraform 0.12 and above are supported.

 ## Usage

@@ -84,7 +84,7 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
 | aws | ~> 2.35 |

 ## Providers
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = "~> 0.12.6"
+  required_version = ">= 0.12.6, < 0.14"

   required_providers {
     aws = "~> 2.35"
---

---

Choice B:
README.md
@@ -22,7 +22,7 @@ These features of S3 bucket configurations are supported:

 ## Terraform versions

-Only Terraform 0.12 is supported.
+Terraform 0.12 and above are supported.

 ## Usage

@@ -84,7 +84,7 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
 | aws | ~> 2.35 |

 ## Providers
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = "~> 0.12.6"
+  required_version = ">= 0.12.6, < 0.14"

   required_providers {
     aws = Name 2.35"
---

---

Choice C:
README.md
@@ -22,7 +22,7 @@ These features of S3 bucket configurations are supported:

 ## Terraform versions

-Only Terraform 0.12 is supported.
+Terraform 0.12 and above are supported.

 ## Usage

@@ -84,7 +84,7 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
 | aws
-Only ~> 2.35 |

 ## Providers
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = "~> 0.12.6"
+  required_version = ">= 0.12.6, < 0.14"

   required_providers {
     aws = "~> 2.35"
---

---

Choice D:
README.md
@@ -22,7 +22,7 @@ These features of S3 bucket configurations are supported:

 ## Terraform versions

-Only Terraform 0.12 is supported.
+Terraform 0.12 and above are supported.

 ## Usage

@@ -84,7 +84,7 @@ module "s3_bucket" {

 | Name | Version |
 |------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
 | aws | ~> 2.35 |

 ## Providers
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = "~> 0.12.6"
+  required_version =
@@ 0.12.6, < 0.14"

   required_providers {
     aws = "~> 2.35"
---

---