feat(stepfunctions): expectedBucketOwner parameter for cross-account s3 access

[agbhinav]

Issue # (if applicable)

N/A, but has been a point of inquiry on the step functions Slack channel multiple times.

Reason for this change

Step functions support cross account bucket access but it only works if we include the ExpectedBucketOwner parameter in the S3 API call, we can do that by including the ExpectedBucketOwner attribute in the parameters of ItemReader

Description of changes

What code changes did you make?
Added the ExpectedBucketOwner as a optional parameter in the ItemReader construct, an ItemReader construct is used when a distributed map state wants to perform a file/object read from S3 and distribute the results. Changing the ItemReader has a cascading effect of also changing S3ObjectsItemReader, S3FileItemReader and their children constructs as all of them inherit the ItemReaderProps.

I also changed the render method for both of the object and file reader constructs to add the optional ExpectedBucketOwner attribute in the JSON object that it returns.

Why do these changes address the issue?
We needed to have the ExpectedBucketOwner attribute in the parameters in order of a cross account bucket access request made in a distributed map state to go through.

What alternatives did you consider and reject?
The only alternative to this would be to inject ASL directly into CDK rather than using the CDK constructs, but I deemed that to be unsafe due to linting/rendering and other human errors which could be injected because of that.

What design decisions have you made?
The only choice as such was to make the expectedBucketOwner attribute as an optional attribute to make sure that the ItemReader still works without the attribute because it is not strictly required if you are not making a cross account bucket access.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Confirmed that ItemReader can use the ExpectedBucketOwner attribute as documented here

I made changes in unit tests wherein I added the expectedBucketOwner: '1234567890' attribute to the ItemReader and made sure that it rendered correctly in the the output. I also decided to make sure to leave out the attribute in some of the unit tests to make sure the ItemReader works correctly without it as it is supposed to be an optional parameter. I ran all the unit tests in the aws-stepfunctions suite and they all passed.

For the integration tests I added the expectedBucketOwner attribute and set it to the current account and saw that the CDK template rendered correctly and the integration test also completed.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license