Provisions S3 Access Points and dependent primitives with production defaults: network-origin selection (Internet vs VPC), VPC endpoint + private DNS, the through-AP-only bucket invariant via s3:DataAccessPointArn bucket-policy Deny, per-AP prefix-scoped policies distinct from the bucket policy, Object Lambda APs (supporting AP + transform Lambda + reserved concurrency), Multi-Region Access Points (MRAP) with failover, DNS-compatible aliases, per-AP Block Public Access, cross-account AP delegation with containment, and S3 on Outposts APs.
