Broaden standard S3 read permissions to include all Get useful get operations

[andrewpatto]

There is a broader scope of S3 permissions now

GetObjectAttributes
GetObjectTagging

When we are doing a reasonably broad share objects from one bucket to another say (for general services that might need access) - I suggest we include the wider set of Get permissions.

Clients don't have to use them - but for instance - GetObjectAttributes can be used to list the checksums of a multipart upload which might be useful to something.
Same with tags - unless we have a reason that we would want to prevent clients from seeing tags - this leaves it up to them as to whether they want to copy them or not.

[andrewpatto]

Similarly, if the bucket in questions is versioned - we should have

s3:GetObjectVersion
s3:GetObjectVersionAttributes

because clients in general might be interested in looking at the history of an object

[andrewpatto]

This is only in a scenario where we have "unknown" but trusted clients.. i.e. shares between two of our own prod accounts..

[victorskl]

Related https://umccr.slack.com/archives/C02LGHE2G/p1731627446621679

[andrewpatto]

This turned out to bite us with a rclone copy (orchestrated from prod - copying uom-data to wehi).

Suggest we prioritise this - at least as far as the permissions shared from prod pipeline in uom-data - shared at an account level to prod.

[andrewpatto]

I have manually changed the policy statement in pipeline-prod-cache-503977275616-ap-southeast-2
to

{
            "Sid": "prod_lo_access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::472057503814:root"
            },
            "Action": [
                "s3:List*",
                "s3:GetObject",
                "s3:GetObjectAttributes",
                "s3:GetObjectTagging",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersionAttributes",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::pipeline-prod-cache-503977275616-ap-southeast-2/*",
                "arn:aws:s3:::pipeline-prod-cache-503977275616-ap-southeast-2"
            ]
        },

so would be good to have this set permanently for the next terraform deploy.