S3 bucket policy prohibited on web-server mode

[caiofralmeida]

Hi folks,

We are using the policy that prohibits buckets with policy, but we have a case where we want to run a bucket as a web server with static content, for that we need to make it public and apply an internal access policy.

This scenario generates a false positive alert. I would like to know if it would make any sense to have the possibility to skip a specific resource from a custom tag?

If this solution is feasible, I would like to contribute.