Refuse to overwrite publisher statements in the backup bucket policy.

The original apply script only knows the resource-control statements. It now stops when the live policy has more.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54

tools/apply-backup-bucket-policy.sh

@@ -134,6 +134,13 @@ client = boto3.client(
     aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
     aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
 )
+current = json.loads(client.get_bucket_policy(Bucket=bucket)["Policy"])
+extra = sorted({item.get("Sid") for item in current.get("Statement", [])} - {item.get("Sid") for item in policy["Statement"]})
+if extra:
+    raise SystemExit(
+        "refusing to replace the bucket policy; live statements are not in this script: "
+        + ",".join(extra)
+    )
 client.put_bucket_policy(Bucket=bucket, Policy=json.dumps(policy))
 print("bucket_policy=put")
 got = client.get_bucket_policy(Bucket=bucket)