S3UTILS-222 Tool to update CRR policies

[Copilot]

Adds a replicationAudit toolset to audit and fix missing s3:ReplicateObject permissions on CRR roles.

New scripts

• list-buckets-with-replication.sh — Discovers all buckets with replication enabled via bucketd metadata API
• check-replication-permissions.js — Checks each replication role's attached policies for s3:ReplicateObject by querying Vault metadata directly via repd protocol (no credentials needed)
• fix-missing-replication-permissions.js — Creates and attaches IAM policies with s3:ReplicateObject for roles missing it, using temporary account access keys with 15-minute auto-expiry

Key design choices

• Idempotent: CreatePolicy reuse via EntityAlreadyExistsException handling; AttachRolePolicy is a no-op if already attached
• Minimal blast radius: One policy per role named s3-replication-audit-fix-<roleName>, scoped only to affected bucket ARNs
• Temp key lifecycle: Keys cached per account (reused across roles in same account), deleted after use, auto-expire as safety net
• --dry-run mode for safe pre-flight checks
• process.exit(0) after completion to avoid hanging on keepAlive HTTP agents

Other changes

• Moved @aws-sdk/client-iam from devDependencies to dependencies (now used in production script)
• check-replication-permissions.js output now includes ownerDisplayName (breaking change, documented)
• Test utility deleteTestAccount updated to handle multi-bucket cleanup and policy deletion
• Unit tests for policyAllowsReplication (24 cases) and functional tests covering dry-run, idempotency, multi-bucket, multi-role, and cross-account scenarios

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fastdl.mongodb.org
  • Triggering command: /opt/hostedtoolcache/node/24.13.1/x64/bin/node /opt/hostedtoolcache/node/24.13.1/x64/bin/node ./postinstall.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)