[Asset Inventory POC] Fetch S3 buckets

[romulets]

Summary of your changes

Fetch S3 data for the Asset Inventory POC.

Decided to stick to what cloudbeat already fetches. It might change in the future, depending on what product requests.

Known Issues

The Bucket Policy Statement Principal can be a string "*" (allows anyone to assume the role) or an object with an specific principal. This is how aws defines it. Because we can't index fields string or object an error is thrown without any mapping. Either saying that can't convert object to string or can't convert string to object.

To prevent this, add this index with elastic console:

PUT /asset_inventory_infrastructure_storage_object-storage_s3
{
  "mappings": {
    "properties": {
      "asset.raw.bucket_policy": {
        "enabled": false
      }
    }
  }
}

That will disable indexing of asset.raw.bucket_policy. The whole policy will be indexed via resource_policies field

Screenshot/Data

Related Issues

• Related: https://github.com/elastic/security-team/issues/8710

[mergify]

This pull request does not have a backport label. Could you fix it @romulets? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  NOTE: backport-skip has been added to this pull request.

[github-actions]

📊 Allure Report - 💚 No failures were reported.

Result	Count
🟥 Failed	0
🟩 Passed	162
⬜ Skipped	0