[CANOFY-105] Create Client S3 Bucket¶

Type: Story
Epic: New Client Onboarding — Automated AWS + Frappe Provisioning
Stage key: s3_bucket (pipeline stage 5 of 15)
Component: utils/aws_client.py

User Story¶

As an operations engineer,
I want a dedicated, encrypted S3 bucket created for each new client, so that** client file attachments are isolated per-client, encrypted at rest, and never require AWS access keys stored anywhere in Frappe.

Description¶

Create an S3 bucket named deterministically from the site name, with default SSE-S3 encryption enabled and public access blocked. The bucket name is recorded on the request
(s3_bucket_created) and threaded through the pipeline context
(s3_bucket_name) for later stages (iam_setup, ocr_policy_update,
frappe_config's S3 File Settings step).

Configuration / Prerequisites¶

• Canofy Client.client_code must be set and unique — bucket naming
  collides otherwise.
• AWS account must have S3 bucket-creation permission and no conflicting
  bucket name already existing globally (S3 bucket names are globally
  unique across all AWS accounts, not just this one).

Acceptance Criteria¶

• Bucket created with a deterministic, predictable name derived from
  client_code.
• Default encryption (SSE-S3 or SSE-KMS) enabled on the bucket.
• Public access is blocked (all four "Block Public Access" settings on).
• Bucket name recorded on Onboarding Request.s3_bucket_created.
• Re-running this stage against an already-existing bucket (from a
  previous partial run) does not fail — treats "already exists and
  owned by us" as success, not an error.

Test Cases¶