Provisions S3 bucket policies with production defaults: policy structure (Principal, Action, Resource, Condition), common patterns (HTTPS-only via aws:SecureTransport Deny, cross-account with external ID, VPC-endpoint-only via aws:SourceVpce, CloudFront Origin Access Control, AWS service access), policy vs ACL (policy preferred — ACLs are legacy), 20 KB policy size limit, condition keys (aws:SourceIp, aws:SourceVpc, aws:SourceVpce, s3:x-amz-acl, aws:SecureTransport), S3 Access Points policy delegation, S3 Multi-Region Access Point (MRAP) policy.
