Change in AWS tags causes bucket policy replacement

[voliveira-tmx]

Description

Changing AWS tags leads to policy replacement. I wonder if that is a bug.

PS: I've noticed the same behavior with the EFS AWS Terraform module as well.

• [ X ] ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]: 4.2.1

• Terraform version: v1.8.3

• Provider version(s): 5.80.0

Reproduction Code [Required]

module "s3_bucket_logging" {
  source  = "terra.tmx.cloud/tmx-cloud/module-s3-bucket/aws"
  version = "4.2.1"

  bucket = var.s3_bucket_logging_name
  acl    = "log-delivery-write"

  control_object_ownership = true
  object_ownership         = "ObjectWriter"

  attach_lb_log_delivery_policy     = true
  attach_elb_log_delivery_policy    = true
  attach_access_log_delivery_policy = true

  access_log_delivery_policy_source_buckets = [
    "arn:aws:s3:::${var.s3_bucket_logging_name}",
    "arn:aws:s3:::${var.s3_bucket_miscellaneous_name}",
  ]

  versioning = {
    enabled    = true
    status     = true
    mfa_delete = false
  }

  logging = {
    target_bucket = var.s3_bucket_logging_name
    target_prefix = "access-logs/buckets/logging/"
  }

  server_side_encryption_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        sse_algorithm = "AES256"
      }
    }
  }

  tags = var.required_aws_tags
}

Steps to reproduce the behavior:

1. Change the var.required_aws_tags
2. Run a terraform plan.

Expected behavior

I expected to only have tag changes in the plan.

Actual behavior

I see that the policy argument of module.s3_bucket_logging.aws_s3_bucket_policy.this[0] is being replaced.

Terminal Output Screenshot(s)