Missing S3 bucket owner condition
Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket. For example, a configuration error could lead to accidentally writing production data into test accounts.
def verify_s3bucket_owner_noncompliant(event):
    import boto3
    client = boto3.client('s3')
    # Noncompliant: missing S3 bucket owner condition
    # (ExpectedSourceBucketOwner).
    client.copy_object(
        Bucket=event["bucket"],
        CopySource=f"{event['bucket']}/{event['key']}",
        Key=event["key"],
        ExpectedBucketOwner=event["owner"],
    )
def verify_s3bucket_owner_compliant(event):
    import boto3
    client = boto3.client('s3')
    # Compliant: sets the S3 bucket owner condition(ExpectedSourceBucketOwner).
    client.copy_object(
        Bucket=event["bucket"],
        CopySource=f"{event['bucket']}/{event['key']}",
        Key=event["key"],
        ExpectedBucketOwner=event["owner"],
        ExpectedSourceBucketOwner=event["owner2"]
    )