The bucket policy doesn't and can't prevent overwrites. (That said, the bucket does include versioning, so if the object is overwritten, that version can be removed (manually by Infra, as the bucket policy doesn't allow for the credentials we have to remove items) and the original version will be available.) Because removing a version requires extra ceremony and headache, it's important that the publishing of versions be programmatic and include a check to make sure we're not publishing something that already exists (we can enforce the overwriting constraints on our end).
The bucket policy doesn't and can't prevent overwrites. (That said, the bucket does include versioning, so if the object is overwritten, that version can be removed (manually by Infra, as the bucket policy doesn't allow for the credentials we have to remove items) and the original version will be available.) Because removing a version requires extra ceremony and headache, it's important that the publishing of versions be programmatic and include a check to make sure we're not publishing something that already exists (we can enforce the overwriting constraints on our end).