## Module functionality
Module creates s3 bucket policy associated with given bucket.
- Admin operations will be denied for everyone except admins (admin_users_arns and admin_roles variables).
- Delete operations will be denied for everyone except admins, given IAM roles (delete_roles variable) and AWS services (service_identifiers)
- Upload operations will be denied for everyone except admins, given IAM roles (upload_roles and external_upload_roles variables) and AWS services (service_identifiers)
- Read operations will be denied for everyone except admins, given IAM roles (read_roles and external_read_roles variables) and AWS services (service_identifiers)
- Read and upload operations will be explicitly allowed for external read and write roles.
- Read operations will also be available for given IP addresses.