Add new resource: S3 bucket for analytics

[refeed]

Somewhere to land the event exports. One bucket, same region and naming convention as the artifact
store.

It has its own tag block rather than the shared local.tags, because analytics is not owned by the
same team — and the Owner value went out empty, because we do not yet know who picks it up.

That is the kind of thing that gets waved through in review. It is not waved through here: the
governance step reads the plan before anything is applied, sees an aws_s3_bucket whose Owner tag
is empty, and fails. Look at the job — Apply is skipped. The bucket does not get created, and
nobody had to remember to check.

Nothing about the pipeline changed to make that happen. The only diff in this PR is ten lines of
Terraform; the governance step arrived in
chapter 1 and moved to org-enforced
rules in chapter 2, and neither has been
touched since.

This is the chapter to read top to bottom

It is the first one where something actually changes, so it is the first with a diff block — and the
empty Owner is visible in the plan, directly above the rule that refused it:

```diff
+ aws_s3_bucket.analytics                          create
    + bucket = "demo-tirith-action-analytics-790543352839"
    + tags = {"Demo":"...","Name":"...","Owner":""}
    … and 24 computed attribute(s), known after apply
```
Plan: 1 to add, 0 to change, 0 to destroy. 5 unchanged.

The violation is in the change itself, not only in the verdict. Rendered from the masked plan on the
runner, so a value Terraform marked sensitive would never appear there.

Worth noting: this same rule caught it in both modes. It was one of the three files committed in
chapter 1, and it is one of the org
policies from chapter 2 onwards — the
same rule, the same verdict, just a different place to change it.

---

Chapter 3 of 5. Based on #22 · Next: #24 — Give the analytics bucket an owner

[github-actions]

🛡️ Tirith — 1 failed, 1 warned, 9 passed

_{Scanned commit 676d7ca · dir . · workflow github-com-StackGuardian-tirith-action-demo-deploy}

+ aws_s3_bucket.analytics                          create
    + bucket = "demo-tirith-action-analytics-790543352839"
    + force_destroy = false
    + tags = {"Demo":"tirith-action-demo","Name":"tirith-action-demo","Owner":""}
    … and 24 computed attribute(s), known after apply

Plan: 1 to add, 0 to change, 0 to destroy. 5 unchanged.

	Policy	Rule	Resource
⚠️	__sg.checkov-best-practices	checkov-best-practices	aws_s3_bucket.analytics, aws_s3_bucket.artifacts
✅	__sg.repo-scan	ci-long-lived-cloud-credentials	—
✅	__sg.repo-scan	ci-untrusted-actions	—
✅	__sg.repo-scan	ci-risky-triggers	—
✅	__sg.repo-scan	ci-terraform-validation	—
✅	__sg.repo-scan	remote-state-backend	—
✅	__sg.repo-scan	state-encryption	—
✅	__sg.repo-scan	provider-lock-file	—
✅	tirith-demo-cost-ceiling	monthly-cost-ceiling	—
✅	tirith-demo-opa-check	s3-naming-and-region	—
❌	tirith-demo-s3-owner-tag	s3-buckets-must-declare-an-owner	aws_s3_bucket.analytics, aws_s3_bucket.artifacts

⚠️ __sg.checkov-best-practices › checkov-best-practices

• Ensure S3 buckets should have event notifications enabled
• Ensure S3 buckets should have event notifications enabled
• Ensure that S3 bucket has a Public Access block
• Ensure that an S3 bucket has a lifecycle configuration
• Ensure the S3 bucket has access logging enabled
• Ensure all data stored in the S3 bucket have versioning enabled
• Ensure that S3 buckets are encrypted with KMS by default
• Ensure that S3 bucket has cross-region replication enabled
• Ensure that S3 bucket has cross-region replication enabled

Resources:

• aws_s3_bucket.analytics
• aws_s3_bucket.artifacts

❌ tirith-demo-s3-owner-tag › s3-buckets-must-declare-an-owner

• Owner tag on every planned S3 bucket
• `""` is empty
• `"rafid.aslam"` is not empty

Resources:

• aws_s3_bucket.analytics
• aws_s3_bucket.artifacts

_{💵 Estimated monthly cost: 1.00 USD (+1.00 from this change)}

_{✅ 9 passed · View run in StackGuardian}