docs(object-storage): Scope bucket policy examples by org condition

[thedriftofwords]

Summary

• Updates Object Storage bucket policy Terraform examples to use one console user (CW) and one SAML group (AWS) as named principals, aligned with the merged docs PR coreweave/docs#3044.
• Keeps cw:PrincipalOrgID in each example as an extra safety measure.
• Replaces the broad arn:aws:s3:::* data source example with bucket-specific bucket and object ARNs.
• Declares coreweave/coreweave as the provider source in each independently copyable example and regenerates the provider reference docs.

Rationale

The earlier draft used "CW": ["*"]. In HCL, the square brackets are list syntax for the principal map, but * as the identifier is not the correct org-scoped wildcard form. The docs now use named principal ARNs for generic examples and reserve bare "Principal": "*" for explicit org-wide patterns with cw:PrincipalOrgID.

Each example is a standalone root module when copied from the generated reference documentation, so declaring coreweave/coreweave once per example makes it directly initializable without duplicating the declaration for every resource.

Test plan

• Run terraform fmt on the updated example files
• Run make -f GNUmakefile generate
• Run go test ./coreweave/object_storage
• Run git diff --check
• Run terraform init -backend=false and terraform validate for both updated examples.
• Confirm terraform plan -refresh=false reaches provider configuration for both examples. It stops as expected without a CoreWeave API token; no remote resources are created.

Additional validation with documentation example harness

To increase confidence before merge, the changes in this PR were also validated with a credential-free documentation example harness developed on branch cg/DOCS-3002-terraform-example-harness (DOCS-3002). That branch is based on this PR and is not part of this merge scope.

The harness copies each registered example into a temporary directory so no .terraform/ or lockfiles are written under examples/, then runs:

1. terraform fmt -check
2. terraform init -backend=false -input=false
3. terraform validate

Both modules in this PR passed:

• examples/resources/coreweave_object_storage_bucket_policy
• examples/data-sources/coreweave_object_storage_bucket_policy_document

The harness does not run plan or apply, so it does not require CoreWeave API credentials. It confirms that each example resolves coreweave/coreweave, initializes cleanly, and passes schema validation as an independently copyable root module.

Closes DOCS-2126

Made with Cursor

[thedriftofwords]

Working through manual testing, will merge after.

7/30/26 update: Used agent-assisted testing harness for docs examples as described above in PR description; harness used locally to test this PR, and will be added in a subsequent PR after this one is merged.