chore(assets): make error less ominous (#18067)

`cdk-assets` tries to opportunistically read the bucket's encryption
settings and mirror those out into the `PutObject` call, so that a
commonly-used SCP can confirm that there are no unencryped uploads
to S3 buckets, ever. When this read-out fails, we print an error
message at `debug` severity to let users know what's up.

Unfortunately, the error message was very scary and makes users
wonder what is going on:

> Why do I get a debug: ACCES_DENIED error there? Is it a problem?
>
> ```
> verbose: [0%] debug: ACCES_DENIED for getting encryption of bucket
> 'cdk-hnb659fds-assets-111111111111-us-east-1'. Either wrong account
> 111111111111 or s3:GetEncryptionConfiguration not set for cdk role. Try
> "cdk bootstrap" again.
> ```

Make the error message more clearly indicate that this is a failure
in an opportunistic code path and there's no direct action required:

```
Could not read encryption settings of bucket
'cdk-hnb659fds-assets-111111111111-us-east-1': uploading with default
settings ("cdk bootstrap" to version 9 if your organization's policies
prevent a successful upload or to get rid of this message).
```


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: rix0rrr

packages/cdk-assets/lib/private/handlers/files.ts

@@ -62,7 +62,7 @@ export class FileAssetHandler implements IAssetHandler {
         this.host.emitMessage(EventType.DEBUG, `No bucket named '${destination.bucketName}'. Is account ${await account()} bootstrapped?`);
         break;
       case BucketEncryption.ACCES_DENIED:
-        this.host.emitMessage(EventType.DEBUG, `ACCES_DENIED for getting encryption of bucket '${destination.bucketName}'. Either wrong account ${await account()} or s3:GetEncryptionConfiguration not set for cdk role. Try "cdk bootstrap" again.`);
+        this.host.emitMessage(EventType.DEBUG, `Could not read encryption settings of bucket '${destination.bucketName}': uploading with default settings ("cdk bootstrap" to version 9 if your organization's policies prevent a successful upload or to get rid of this message).`);
         break;
     }
 

packages/cdk-assets/test/files.test.ts

@@ -244,9 +244,6 @@ test('no server side encryption header if access denied for bucket encryption',
   expect(aws.mockS3.upload).toHaveBeenCalledWith(expect.not.objectContaining({
     ServerSideEncryption: 'AES256',
   }));
-
-  // Error message references target_account, not current_account
-  expect(progressListener.messages).toContainEqual(expect.stringMatching(/ACCES_DENIED.*target_account/));
 });
 
 test('correctly looks up content type', async () => {