Give the analytics bucket an owner

[refeed]

Data platform is picking it up, so the tag
chapter 3 left blank now has a value.

One line. The Owner rule passes, the verdict goes green, and Apply stops being skipped — the bucket
can ship.

That is the part worth watching. The check that blocked the merge is not a wall around the pipeline; it
is a step inside it, and it clears the moment the thing it objected to is fixed. No ticket, no
exception process, no separate tool to go and look at.

The diff block still shows the bucket being created, now with a real Owner. The change did not go
away — only the objection to it. Which is the distinction a reviewer actually needs.

---

Chapter 4 of 5. Based on #18 · Next: #20 — Publish the terraform state after apply

[github-actions]

🛡️ Tirith — 1 warned, 3 passed

_{Scanned commit 15f3510 · dir . · workflow github-com-StackGuardian-tirith-action-demo-deploy}

+ aws_s3_bucket.analytics                          create
    + bucket = "demo-tirith-action-analytics-790543352839"
    + force_destroy = false
    + tags = {"Demo":"tirith-action-demo","Name":"tirith-action-demo","Owner":"data-platform"}
    + tags_all = {"Demo":"tirith-action-demo","Name":"tirith-action-demo","Owner":"data-platform"}
    … and 23 computed attribute(s), known after apply

Plan: 1 to add, 0 to change, 0 to destroy. 5 unchanged.

	Policy	Rule	Resource
⚠️	__sg.checkov-best-practices	checkov-best-practices	aws_s3_bucket.analytics, aws_s3_bucket.artifacts
✅	tirith-demo-cost-ceiling	monthly-cost-ceiling	—
✅	tirith-demo-opa-check	s3-naming-and-region	—
✅	tirith-demo-s3-owner-tag	s3-buckets-must-declare-an-owner	—

⚠️ __sg.checkov-best-practices › checkov-best-practices

• Ensure S3 buckets should have event notifications enabled
• Ensure S3 buckets should have event notifications enabled
• Ensure that an S3 bucket has a lifecycle configuration
• Ensure that S3 bucket has a Public Access block
• Ensure that S3 bucket has cross-region replication enabled
• Ensure that S3 bucket has cross-region replication enabled
• Ensure that S3 buckets are encrypted with KMS by default
• Ensure all data stored in the S3 bucket have versioning enabled
• Ensure the S3 bucket has access logging enabled

Resources:

• aws_s3_bucket.analytics
• aws_s3_bucket.artifacts

_{💵 Estimated monthly cost: 1.00 USD (+1.00 from this change)}

_{✅ 3 passed · View run in StackGuardian}