Repository: awslabs/cdk-serverless-clamscan (language: python)

Issue:
Download object is forbidden 403.
Hi, 
this is possibly related to #532 but not entirely sure.

After a successful `cdk deploy` I can see that the bucket policy is attached to the input bucket. The input bucket was set up with `objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED`.

When uploading a file to the input bucket, the tagging works. However, when the scan lambda function tries to download the file, a 403 Forbidden error is thrown.

The download works if I remove the attached bucket policy. 

I was in contact with AWS support to figure out if this is an issue with our setup or with the bucket policy itself. I presume others would run into the same 403 Forbidden issue if the issue would be related to the bucket policy. 
Unfortunately, the AWS support was unable to pinpoint the exact reason of the 403 Forbidden, but they helped me re-write the bucket policy so that it does the same thing (prevent downloading the file unless it's clean) and also have a working download.

According to the docs [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html#specifying-notprincipal), for the `Deny` and `NotPrincipal` combination, it is recommended that the root account is also added to the list of principals. Currently, it is not, but that did not work for me either.


Here is what is working for me, and I believe it achieves the same functionality as before. 
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:ExistingObjectTag/scan-status": [
                        "IN PROGRESS",
                        "INFECTED",
                        "ERROR"
                    ]
                },
                "ArnNotEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:sts::111111111111:assumed-role/my-role/my-function",
                        "arn:aws:iam::111111111111:role/my-role"
                    ]
                }
            }
        }
    ]
}
```

From my testing, this is not a breaking change. 

I will open a PR as well. Do you see any issues that would prevent the merge of the PR?


Discussion / hints:

Fix patch:
diff --git a/src/index.ts b/src/index.ts
index 684b63ba..45134d37 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -516,7 +516,7 @@ export class ServerlessClamscan extends Construct {
         effect: Effect.DENY,
         actions: ['s3:GetObject'],
         resources: [bucket.arnForObjects('*')],
-        notPrincipals: [this._scanFunction.role, scan_assumed_principal],
+        principals: [new AnyPrincipal()],
         conditions: {
           StringEquals: {
             's3:ExistingObjectTag/scan-status': [
@@ -525,6 +525,9 @@ export class ServerlessClamscan extends Construct {
               'ERROR',
             ],
           },
+          ArnNotEquals: {
+            'aws:PrincipalArn': [this._scanFunction.role.roleArn, scan_assumed_principal.arn],
+          },
         },
       });
     } else {


Test patch:
diff --git a/test/ServerlessClamscan.test.ts b/test/ServerlessClamscan.test.ts
index 1dd46c05..48168eac 100644
--- a/test/ServerlessClamscan.test.ts
+++ b/test/ServerlessClamscan.test.ts
@@ -248,18 +248,23 @@ test('check bucket triggers and policies for source buckets ', () => {
                   'ERROR',
                 ],
               },
-            },
-            Effect: 'Deny',
-            NotPrincipal: {
-              AWS: [{
-                'Fn::GetAtt': [
-                  stringLike('*ServerlessClamscan*'),
-                  'Arn',
+              ArnNotEquals: {
+                'aws:PrincipalArn': [
+                  {
+                    'Fn::GetAtt': [
+                      stringLike('*ServerlessClamscan*'),
+                      'Arn',
+                    ],
+                  },
+                  {
+                    'Fn::Join': ['', arrayWith(stringLike('*sts*'), stringLike('*assumed-role*'), { Ref: stringLike('*ServerlessClamscan*') })],
+                  },
                 ],
               },
-              {
-                'Fn::Join': ['', arrayWith(stringLike('*sts*'), stringLike('*assumed-role*'), { Ref: stringLike('*ServerlessClamscan*') })],
-              }],
+            },
+            Effect: 'Deny',
+            Principal: {
+              AWS: '*',
             },
             Resource: {
               'Fn::Join': [