S3 Controller - repeat reconciling

Describe the bug When updating the bucket policy of an S3 bucket, the reconciler applies the change continuously. This was flagged by our cloudwatch alarms. The apply was successful from ACK, however ACK continuously tries to apply what should be a no-op change

Steps to reproduce

Create S3 Bucket with policy
Add a deny statement
See changes applied every reconcile period

Expected outcome No-op after first apply

Environment

Kubernetes version 1.24
Using EKS (yes/no), if so version? EKS 1.27
AWS service targeted (S3, RDS, etc.) S3 controller v1.0.11

The following is the policy that specify policy that was applied, where we only added the 3rd statement entry. The previous policy only contained the first 2 statements. Removing the 3rd policy afterwards, continues to trigger the cloudwatch alarm

        "bucketPolicy": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": "s3:GetBucketAcl",
                    "Condition": {
                        "StringEquals": {
                            "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:XXXXX:trail/trail-UID"
                        }
                    },
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "cloudtrail.amazonaws.com"
                    },
                    "Resource": "arn:aws:s3:::aws-cloudtrail-logs-UID",
                    "Sid": "AWSCloudTrailAclCheck20150319"
                },
                {
                    "Action": "s3:PutObject",
                    "Condition": {
                        "StringEquals": {
                            "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:XXXXXX:trail/trail-UID",
                            "s3:x-amz-acl": "bucket-owner-full-control"
                        }
                    },
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "cloudtrail.amazonaws.com"
                    },
                    "Resource": "arn:aws:s3:::aws-cloudtrail-logs-UID/AWSLogs/XXXXXX/*",
                    "Sid": "AWSCloudTrailWrite20150319"
                },
                {
                    "Action": "s3:PutObject",
                    "Condition": {
                        "StringNotEquals": {
                            "s3:x-amz-server-side-encryption": "AES256"
                        }
                    },
                    "Effect": "Deny",
                    "Principal": "*",
                    "Resource": "arn:aws:s3:::aws-cloudtrail-logs-UID/*",
                    "Sid": "enforce-encryption-method"
                }
            ]
        },

aws-controllers-k8s / community

S3 Controller - repeat reconciling #2070