Update Cumulus to v17.0.0

[mckadesorensen]

Update to Cumulus v17.0.0
Update to Terraform provider to >= 5.0.0

[lindsleycj]

Hi, I think the reason I had that ACL in there is for lower environments. For UAT and PROD deployments the protected and public S3 access logs go to a cloud metrics bucket. But for dev and SIT they don't. So I set it up so those logs go to the internal bucket. It's possible that the ACL is not required since they are in the same account.

https://github.com/asfadmin/CIRRUS-DAAC/blob/master/daac/s3-replicator.tf#L19-L24

https://github.com/asfadmin/CIRRUS-DAAC/blob/master/daac/main.tf#L56-L59

Do you know for sure the ACL can be removed?

[mckadesorensen]

@lindsleycj I removed that line because it was causing the following issue:

Error: updating S3 Bucket (ob-cumulus-sbx-internal) ACL: AccessControlListNotSupported: The bucket does not allow ACLs
        status code: 400, request id: A1JPN6YG6CE98KKD, host id: tFxZkAqZ0uiA6CKLkAhL/Iyo9T8pGEOh6LKSxwbJv1F8uj8EEOHyrzsr8Mfi65z3i9OPb6AzLcw=

  on main.tf line 24, in resource "aws_s3_bucket" "internal-bucket":
  24: resource "aws_s3_bucket" "internal-bucket" {

[lindsleycj]

Ah, I was just looking at what I did on the AWS provider v5 upgrade. I also removed that one line but I added these two blocks to add in the acl:

resource "aws_s3_bucket_ownership_controls" "internal-bucket" {
  bucket = aws_s3_bucket.internal-bucket.id
  rule {
    object_ownership = "ObjectWriter"
  }
}

resource "aws_s3_bucket_acl" "internal-bucket" {
  depends_on = [aws_s3_bucket_ownership_controls.internal-bucket]
  bucket     = aws_s3_bucket.internal-bucket.id
  acl        = "log-delivery-write"
}

[mckadesorensen]

@lindsleycj That works.

[lindsleycj]

I think this is ready to merge. Thank @mckadesorensen!

Do you want me to do the merge and release?