backend/s3: Ignore default workspace prefix errors

[gdavison]

In versions prior to v1.6, the S3 backend ignored all errors other than NoSuchBucket when listing workspaces. This allowed cases where the user did not have access to the default workspace prefix env: to succeed.

In order to preserve this behaviour, now ignore AccessDenied errors when the user does not have access to the default workspace prefix. If workspace_key_prefix is specified, AccessDenied errors will cause a failure.

Updates documentation to list permissions needed when using workspaces.

Fixes #34223

Target Release

1.7.0

Draft CHANGELOG entry

BUG FIXES

• backend/s3: No longer returns error when IAM user or role does not have access to the default workspace prefix env:

[jar-b]

LGTM 🎉

% TF_ACC=1 go test ./internal/backend/remote-state/s3/...
ok      github.com/hashicorp/terraform/internal/backend/remote-state/s3 150.979s

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.