what

• Set aws_s3_bucket_ownership_controls to BucketOwnerPreferred

why

• Per docs this setting will let object uploader decide ownership. If bucket-owner-full-control ACL is specified, the bucket account take ownership, otherwise the writer account keeps ownership. Bucket on its side may enforce presence of the bucket-owner-full-control ACL which we already do when needed. So this setting was the only missing piece to make ownership work like we expected
• I found no use cases for the other value of this resource: ObjectWriter. It corresponds to legacy S3 behavior which was broken for us. Decided to always set to BucketOwnerPreferred and not allow to customize. If the owner must be preserved, we should not pass bucket-owner-full-control - this is a more clear way to control the behavior.

references

• https://aws.amazon.com/blogs/storage/enforcing-ownership-of-amazon-s3-objects-in-a-multi-account-environment/
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls#ObjectWriter