fix: allow backup bucket health probe

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02992-fff7-75c3-98ac-ca2afe0f7122

tools/apply-backup-bucket-policy.sh

@@ -84,18 +84,30 @@ policy = {
     "Id": "resource-control-scoped-backup",
     "Statement": [
         {
-            "Sid": "BackupListPrefix",
+            # HeadBucket is authorized by s3:ListBucket but carries no
+            # s3:prefix condition key. Keep this bucket-level probe explicit
+            # and TLS-only; object access remains restricted below.
+            "Sid": "BackupBucketProbe",
             "Effect": "Allow",
             "Principal": {"SCW": f"application_id:{app}"},
             "Action": [
                 "s3:ListBucket",
-                "s3:ListBucketMultipartUploads",
-                "s3:ListBucketVersions",
                 "s3:GetBucketLocation",
                 "s3:GetBucketVersioning",
                 "s3:GetLifecycleConfiguration",
             ],
             "Resource": [bucket],
+            "Condition": {"Bool": {"aws:SecureTransport": "true"}},
+        },
+        {
+            "Sid": "BackupListPrefix",
+            "Effect": "Allow",
+            "Principal": {"SCW": f"application_id:{app}"},
+            "Action": [
+                "s3:ListBucketMultipartUploads",
+                "s3:ListBucketVersions",
+            ],
+            "Resource": [bucket],
             "Condition": {"StringLike": {"s3:prefix": [prefix, prefix + "*"]}},
         },
         {
@@ -147,6 +159,12 @@ bucket = os.environ["BUCKET"]
 prefix = os.environ["PREFIX"]
 ok = prefix + ".policy-probe"
 sib = "other-consumer/.policy-probe"
+try:
+    c.head_bucket(Bucket=bucket)
+    print("head_bucket=ok")
+except ClientError as e:
+    print("head_bucket=fail", e.response.get("Error", {}).get("Code"))
+    raise
 try:
     c.put_object(Bucket=bucket, Key=ok, Body=b"ok")
     c.delete_object(Bucket=bucket, Key=ok)